Elastic.Serilog.Sinks | ECS Logging .NET (original) (raw)

A Serilog sink that writes logs directly to Elasticsearch or Elastic Cloud

Installation

Add a reference to the Elastic.Serilog.Sinks package:

<PackageReference Include="Elastic.Serilog.Sinks" Version="8.6.0" />

Usage

There’s a few ways that you can extend a Serilog LoggerConfiguration:

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Debug()
    .Enrich.FromLogContext()

NOTE: Don’t forget we also publish an Elastic.Apm.SerilogEnricher for the Elastic APM Agent!

Writing to Elasticsearch

.WriteTo.Elasticsearch(new [] { new Uri("http://localhost:9200" )}, opts =>
{
    opts.DataStream = new DataStreamName("logs", "console-example", "demo");
    opts.BootstrapMethod = BootstrapMethod.Failure;
    opts.ConfigureChannel = channelOpts =>
    {
        channelOpts.BufferOptions = new BufferOptions
        {
            ConcurrentConsumers = 10
        };
    };
}, transport =>
{
    // transport.Authentication(new BasicAuthentication(username, password));
    // transport.Authentication(new ApiKey(base64EncodedApiKey));
})
  1. Basic Auth
  2. ApiKey

Writing to Elastic Cloud:

.WriteTo.ElasticCloud("cloudId", "cloudUser", "cloudPass", opts =>

opts is an instance of ElasticsearchSinkOptions with the following options

Configuration

Option Description
Transport An instance of Elastic.Transport that dictates where and how we are communicating to. Defaults to http://localhost:9200
DataStream Where to write data, defaults to the logs-dotnet-default datastream.
BootstrapMethod Wheter the sink should attempt to install component and index templates to ensure the datastream has ECS mappings. Can be be either None (the default), Silent (attempt but fail silently), Failure (attempt and fail with exceptions if bootstrapping fails).
TextFormatting Allows explicit control of over the EcsTextFormatterConfiguration used to emit ECS json documents. See Elastic.CommonSchema.Serilog for available options.
ConfigureChannel A callback receiving the DatastreamChannelOptions which allows you to control sizing, backpressure etc. See Elastic.Ingest.Elasticsearch for more information.

Note that you can also pass ElasticsearchSinkOptions directly

.WriteTo.Elasticsearch(new ElasticsearchSinkOptions(client.Transport))

This allows you to reuse the Transport used by the Elasticsearch Client for instance.

Authentication

When Elasticsearch security features are enabled, requests without a valid authentication header will be rejected. You can enable authentication via one of the methods below:

Basic Auth

.WriteTo.Elasticsearch(new [] { new Uri("http://localhost:9200" )}, opts =>
{
    ...
}, transport =>
{
    transport.Authentication(new BasicAuthentication(username, password));
})
  1. Basic authentication

API Key

.WriteTo.Elasticsearch(new [] { new Uri("http://localhost:9200" )}, opts =>
{
    ...
}, transport =>
{
    transport.Authentication(new ApiKey(base64EncodedApiKey));
})
  1. API Key

To learn more about authentication with the Elastic Stack, see User Authentication.

ECS aware message templates

This sink by proxy of its formatter allows you to set ECS fields directly from the message template using properties that adhere to the https://messagetemplates.org/ format.

The available ECS message template properties are listed under LogTemplateProperties.* e.g LogTemplateProperties.TraceId

Log.Information("The time is {TraceId}", "my-trace-id");

Will override trace.id on the resulting ECS json document.

Troubleshooting

In case of issues, you can enable the Serilog Self-Log feature to expose any error you might have encountered.

Comparison with Serilog.Sinks.Elasticsearch

Notable absent features:

If you miss a particular feature from Serilog.Sinks.Elasticsearch in Elastic.Serilog.Sinks please open a feature request! We’d love to grow this sink organically moving forward.