# How to integrate elk with log4.net and mssql

**URL:** <https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282>\
**Category:** Elasticsearch\
**Created:** [June 9, 2016, 6:24am UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282 "2016-06-09T06:24:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubul](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@dubul](https://discuss.elastic.co/u/dubul)\
**Post date:** [June 9, 2016, 6:24am UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282/1 "2016-06-09T06:24:10Z")

</div>

1. I want to integrate [log4.net](http://log4.net) with elk, such that the data from [log4.net](http://log4.net) can be displayed on the kibana.  
How can we do? what should installed on the clients?
2. I want to send the MS SQL data to elk, how can we send the data and displayed on the kibana?

Can you suggest me what to install on the clients and what configs should be done

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 13, 2016, 6:02pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282/2 "2016-06-13T18:02:15Z")

</div>

1. Logstash has numerous input plugins that are capable of receiving events over the network via various protocols. For example, I'm sure there are appenders (or whatever they're called in log4net) for sending via TCP or UDP. Alternatively, have log4net write logs to a local file and use Filebeat to ship the contents of that file. More reliable but also more infrastructure to deal with.
2. You mean you want to index the actual data in the MS SQL database? Have a look at the jdbc input plugin.

---

<div class="post-metadata">

**Author:** ![esds2000](https://avatars.discourse-cdn.com/v4/letter/e/858c86/32.png) [@esds2000](https://discuss.elastic.co/u/esds2000)\
**Post date:** [June 13, 2016, 7:30pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282/3 "2016-06-13T19:30:52Z")

</div>

We recently converted our log4net (and elmah) logging from MSSQL to elastic. This library made the process very simple: [https://github.com/urielha/log4stash](https://github.com/urielha/log4stash). It can write to elastic directly or to logstash via the es\_bulk input with very minimal changes to your log4net.config. [https://github.com/jptoto/log4net.ElasticSearch](https://github.com/jptoto/log4net.ElasticSearch) is a similar library we looked at, but not the one we used.

---

<div class="post-metadata">

**Author:** ![jimbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jimbo/32/12494_2.png) [@jimbo](https://discuss.elastic.co/u/jimbo)\
**Post date:** [October 14, 2016, 7:55am UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282/4 "2016-10-14T07:55:27Z")

</div>

Hi Stephen - you mentioned being able to send to logstash using the es\_bulk input? Can you give me more info on that? I cant seem to find any reference to it on the net but would prefer to send my log4stash logs to logstash first.

Thanks

---

<div class="post-metadata">

**Author:** ![esds2000](https://avatars.discourse-cdn.com/v4/letter/e/858c86/32.png) [@esds2000](https://discuss.elastic.co/u/esds2000)\
**Post date:** [November 18, 2016, 6:09pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282/5 "2016-11-18T18:09:10Z")

</div>

With the log4stash library we just had to add an elasticsearch appender block to our log4net.config. Something like below where the LOGSTASH\_END\_POINT is the host or load balancer for you logstash instances.

```
<appender name="ElasticSearchAppender" type="log4net.ElasticSearch.ElasticSearchAppender, log4stash">
<threshold value="ERROR"/>
<Server>LOGSTASH_END_POINT</Server>
<Port>8080</Port>
<Bulksize>100</Bulksize>
<ElasticFilters>
  <Add>
    <Key>indexname</Key>
    <Value>INDEX_NAME</Value>
  </Add>
  <kv />
</ElasticFilters>

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:05pm UTC](https://discuss.elastic.co/t/how-to-integrate-elk-with-log4-net-and-mssql/52282/6 "2017-07-05T22:05:36Z")

</div>