"Message" field is not send by Serilog ElasticSearch sink

Question

I configured application to send logs to elastic search. I use https://www.elastic.co/cloud/ Everything seems to work fine except one thing: logs appear to not have "message" field (messageTemplate is there). I checked fiddler and it seems that request that posts json lacks this field, so I assume the issue is in library somewhere. Does anyone know what can be a reason?

Example of json sent to elastic:

{"index":{"_type":"_doc","_index":"logstash-2021.11.08"}}
{"@timestamp":"2021-11-08T19:53:37.5417821+02:00","level":"Information","messageTemplate":"Started notification {Notification}","fields":{"Notification":"SendResetPasswordNotification","SourceContext":"****LoggingMediator","ActionId":"59629d88-ab88-476f-a258-8d984142b223","ActionName":"*****AccountController.SendReset)","RequestId":"0HMD2S2FGO4IP:00000001","RequestPath":"/api/v1/account/sendReset","SpanId":"|565f9fbf-466b083f5ac1a8f5.","TraceId":"565f9fbf-466b083f5ac1a8f5","ParentId":"","ConnectionId":"0HMD2S2FGO4IP","Client":null,"CorrelationId":"a892d398-6a79-47a4-aaf7-d83e12cbd468","Application":"****.Identity.Api","Version":"1.0.0.0","Environment":"Dev"}}

Configuration:

"Serilog": {
    "Using": [
        "Serilog.Sinks.ElasticSearch"
    ],
    "Enrich": [
        "FromLogContext"
    ],
    "MinimumLevel": {
        "Default": "Debug",
        "Override": {
            "Microsoft": "Warning",
            "System": "Error",
            "Microsoft.Hosting.Lifetime": "Information"
        }
    },
    "WriteTo": [
        {
            "Name": "Elasticsearch",
            "Args": {
                "nodeUris": "url to elastic",
                "autoRegisterTemplate": true,
                "autoRegisterTemplateVersion": "ESv7",
                "customFormatter": "Serilog.Formatting.Elasticsearch.ExceptionAsObjectJsonFormatter, Serilog.Formatting.Elasticsearch"
            }
        }
    ]
}

Denys Isaev · Accepted Answer · 2021-11-12 15:34:26Z

2

So reason was that by default Serilog.Formatting.Elasticsearch.ExceptionAsObjectJsonFormatter has renderMessage flag set to false. The solution was to create custom formatter derived from ExceptionAsObjectJsonFormatter and set renderMessage flag in constructor to true

answered Nov 12, 2021 at 15:34

Denys Isaev

1116 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

tdhulster Over a year ago

We also had to disable the renderMessageTemplate before getting the expected result :: new ExceptionAsObjectJsonFormatter(renderMessage: true, renderMessageTemplate: false)

Collectives™ on Stack Overflow

"Message" field is not send by Serilog ElasticSearch sink

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related