opened 12:20PM - 24 Jan 23 UTC
**A few questions before you begin:**
> Is this an issue related to the [Seri… log core project](https://github.com/serilog/serilog) or one of the [sinks](https://github.com/serilog/serilog/wiki/Provided-Sinks) or
[community projects](https://github.com/serilog/serilog/wiki/Community-Projects).
This issue list is intended for Serilog Elasticsearch Sink issues. If this issue relates to another sink or to the code project,
please log on the related repository. Please use [Gitter chat](https://gitter.im/serilog/serilog) and [Stack Overflow](http://stackoverflow.com/questions/tagged/serilog) for discussions and questions.
**Does this issue relate to a new *feature* or an existing *bug*?**
- [ ] Bug
- [x] New Feature
**What version of Serilog.Sinks.Elasticsearch is affected? Please list the related NuGet package.**
9.0.0-alpha-*
**What is the target framework and operating system? See [target frameworks](https://docs.microsoft.com/en-us/nuget/schema/target-frameworks) & [net standard matrix](https://docs.microsoft.com/en-us/dotnet/standard/net-standard).**
- [x] net 7.0
- [x] net 6.0
- [x] 4.8
As a part of integration effort between .NET and Elasticsearch, Elastic team provides [Elastic Common Schema .NET](/elastic/ecs-dotnet) repository which includes two sub-projects:
- [Elastic Common Schema .NET](/elastic/ecs-dotnet/tree/main/src/Elastic.CommonSchema#elastic-common-schema-net) which contains a full C# representation of [Elastic Common Schema](https://github.com/elastic/ecs) (ECS) and `esc-*` index templates.
- [Elastic Common Schema Serilog Text Formatter](/elastic/ecs-dotnet/tree/main/src/Elastic.CommonSchema.Serilog#elastic-common-schema-serilog-text-formatter) which provides `Serilog.Formatting.ITextFormatter` implementation in the form of `Elastic.CommonSchema.Serilog.EcsTextFormatter`, for easy integration with Serilog:
```csharp
var logger = new LoggerConfiguration()
.WriteTo.Console(new EcsTextFormatter())
.CreateLogger();
```
The issue is a follow-up to #254 and #227, containing more up-to-date information and first look at the integration.
Simple experiment with naïve `Serilog.Sinks.Elasticsearch` integration, where `EcsTextFormatter` simply replaces current default formater `ElasticsearchJsonFormatter`:
```csharp
public static ITextFormatter CreateDefaultFormatter(ElasticsearchSinkOptions options)
{
//return new ElasticsearchJsonFormatter(
// formatProvider: options.FormatProvider,
// closingDelimiter: string.Empty,
// serializer: options.Serializer != null ? new SerializerAdapter(options.Serializer) : null,
// inlineFields: options.InlineFields,
// formatStackTraceAsArray: options.FormatStackTraceAsArray
//);
return new EcsTextFormatter();
}
```
...produces following output in Elasticsearch/Kibana v8.6.0:
Open questions would be:
- What would be minimal acceptable implementation (e.g. default `EcsTextFormatter` settings work just fine with Elasticsearch, using dynamic fields mapping, without any template registration)? Full implementation, with parity of features is something that would probably take a lot of rewrite effort and testing.
- What to do with existing formatters? Should they be supported side-by-side (at least for the moment)?
I use GitHub - denis-peshkov/Serilog.Enrichers.HttpContext: Enriches Serilog events with client IP, Correlation Id, RequestBody, RequestQuery, HTTP request headers and information of the memory usage. to extract http header values and have the following configuration in appsettings.json:
"WriteTo": [
{
"Name": "Console",
"Args": {
"outputTemplate": "[{Timestamp}] {Level} {EventId} IP:{ClientIp} CorrelationId:{CorrelationId} Agent:{UserAgent} ContentType:{ContentType} ContentLength:{ContentLength} RequestBody:{RequestBody} RequestQuery:{RequestQuery} MemoryUsage:{MemoryUsageExact}/{MemoryUsage} {Message:j} {Properties} {NewLine}{Exception}{NewLine}",
"customFormatter": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog"
}
},
However, the log I get doesn't seem to be json formatted:
[04/21/2025 12:38:02 +08:00] Information { Id: 2, Name: "ResponseLog" } IP:::1 CorrelationId:null Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 ContentType:null ContentLength:null RequestBody: RequestQuery: MemoryUsage:/338575360 Response:
StatusCode: 200
Content-Type: image/x-icon
Accept-Ranges: bytes
ETag: [Redacted]
Last-Modified: Thu, 16 Jun 2022 07:02:55 GMT
Content-Length: 32038 { StatusCode: 200, Content-Type: "image/x-icon", Accept-Ranges: "bytes", ETag: "[Redacted]", Last-Modified: "Thu, 16 Jun 2022 07:02:55 GMT", Content-Length: "32038", SourceContext: "Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware", RequestId: "0HNC0HP5TD59L:00000023", RequestPath: "/favicon.ico", ConnectionId: "0HNC0HP5TD59L", ThreadId: 25, X_Original_For: null, X_Forwarded_Proto: null, X_Original_Proto: null, X_Forwarded_Host: null, X_Original_Host: null }
[04/21/2025 12:38:02 +08:00] Information { Id: 2 } IP:::1 CorrelationId:null Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 ContentType:image/x-icon ContentLength:32038 RequestBody: RequestQuery: MemoryUsage:/339099648 Request finished "HTTP/2" "GET" "https"://"[::1]:4433""""/favicon.ico""" - 200 32038 "image/x-icon" 10.8386ms { SourceContext: "Microsoft.AspNetCore.Hosting.Diagnostics", RequestId: "0HNC0HP5TD59L:00000023", RequestPath: "/favicon.ico", ConnectionId: "0HNC0HP5TD59L", ThreadId: 13, X_Original_For: null, X_Forwarded_Proto: null, X_Original_Proto: null, X_Forwarded_Host: null, X_Original_Host: null }