Serilog and Filebeat Compatibility

Elastic Stack Beats
1

Quite specific to our setup but:

  • we are currently using Filebeat to ship logs to Elasticsearch
  • we want to slowly migrate to using Serilog sinks to ship to Elasticsearch
  • we have a number of dashboards setup for the existing index that we don't want to lose or duplicate

Is there any way to get Serilog Sink and Filebeat to ship to the same index? The standard formatters for Serilog seem incompatible. They are formatting the log messages differently. For example Filebeat ships with values like "Properties.Source" but Serilog (using the ElasticsearchJsonFormatter) ships the same message as as "Fields.Source".

I might just need to bite the bullet and make it a breaking change with a new index.

2

Welcome to our community! :smiley:

There's no such compatibility, you will need to make the changes to accomodate what you want.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.