APM .net agent see the Service Name in the logs for correlated transactions

Kibana version:
7.16.3 (Docker)

Elasticsearch version:
7.16.3 (Docker)

APM Server version:
7.16.3 (Docker)

APM Agent language and version:

    <PackageReference Include="Elastic.Apm.NetCoreAll" Version="1.16.1" />
    <PackageReference Include="Elastic.Apm.SerilogEnricher" Version="1.5.3" />
    <PackageReference Include="Elastic.Apm.StackExchange.Redis" Version="1.16.1" />

Description of the problem including expected versus actual behavior. Please include screenshots (if relevant):
I use correlated transactions across multiple microservices (.net 6) using the .net APM agent, it works pretty well.
My problem is about logs, I don't know why the Service Name does not appear, so that I'm not able to distinguish which log belongs to which microservice.

Example here is an example of a correlated transaction

and the corresponding logs, but with an empty Service Name column

My Serilog logger instance is built this way :

        public static Logger GetELKLogger(IConfiguration config, string varEnv = "ElasticSearchLog")
            var configuration = config.Get<Configuration>(varEnv);

            return new LoggerConfiguration()
            .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri(configuration.ElasticSearchLog))
                AutoRegisterTemplate = true,
                IndexFormat = "mslogs-{0:yyyy.MM.dd}",
                DetectElasticsearchVersion = true,
                RegisterTemplateFailure = RegisterTemplateRecovery.IndexAnyway,
                AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7,
                FailureCallback = e => Console.WriteLine($"Unable to submit event {e?.RenderMessage()} to ElasticSearch. Exception : " + e?.Exception?.ToString()),
                EmitEventFailure = EmitEventFailureHandling.WriteToSelfLog |
                                        EmitEventFailureHandling.WriteToFailureSink |
                BufferCleanPayload = (failingEvent, statuscode, exception) =>
                    dynamic e = JObject.Parse(failingEvent);
                    return JsonConvert.SerializeObject(new Dictionary<string, object>()
                            { "action", "DeniedByElasticSearch"},
                            { "@timestamp",e["@timestamp"]},
                            { "level","Error"},
                            { "message","Error: "+e.message},
                            { "messageTemplate",e.messageTemplate},
                            { "failingStatusCode", statuscode},
                            { "failingException", exception}
                CustomFormatter = new EcsTextFormatter()

My minimal appsettings.json for each Microservice is

  "Serilog": {
    "Using": [],
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft": "Warning",
        "System": "Information",
        "Elastic": "Warning",
        "Apm": "Warning"
    "WriteTo": [
        "Name": "Console"
    "Enrich": [
    "Properties": {
      "ApplicationName": "IT.Microservices.AbandonedCartEmailSender"
  "ElasticApm": {
    "Enabled": true,
    "TransactionSampleRate": 1,
    "CaptureBody": "all",
    "CaptureHeaders": true,
    "SpanFramesMinDuration": 0, // no stacktrace except for exception
    "CloudProvider": "none"
  "ElasticSearchLog": {
    "ElasticSearchLog": "http://elasticsearch:9200/"

What did I miss to have the Service Name in APM ?

Hi @Nicolas_Rey,

the service name is not yet automatically added by the .NET APM Agent to the log line. This is something we already discuss to implement (not timeline at this point).

Currently the agent adds trace id and transaction id to log lines, but not the service name.

One thing you may be able to do is to manually add it (I know, this is less than ideal).

You can query the service name by looking at the currently active transaction:


At this point it's probably better to just wait for an implementation of this.