`WriteTo` JSON formatter

[khteh]

serilog-contrib/serilog-sinks-elasticsearch#494
I use https://github.com/denis-peshkov/Serilog.Enrichers.HttpContext to extract http header values and have the following configuration in appsettings.json:

        "WriteTo": [
            {
                "Name": "Console",
                    "Args": {
                        "outputTemplate": "[{Timestamp}] {Level} {EventId} IP:{ClientIp} CorrelationId:{CorrelationId} Agent:{UserAgent} ContentType:{ContentType} ContentLength:{ContentLength} RequestBody:{RequestBody} RequestQuery:{RequestQuery} MemoryUsage:{MemoryUsageExact}/{MemoryUsage} {Message:j} {Properties} {NewLine}{Exception}{NewLine}",
                        "customFormatter": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog"
                    }
            },

However, the log I get doesn't seem to be json formatted:

[04/21/2025 12:38:02 +08:00] Information { Id: 2, Name: "ResponseLog" } IP:::1 CorrelationId:null Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 ContentType:null ContentLength:null RequestBody: RequestQuery: MemoryUsage:/338575360 Response:
StatusCode: 200
Content-Type: image/x-icon
Accept-Ranges: bytes
ETag: [Redacted]
Last-Modified: Thu, 16 Jun 2022 07:02:55 GMT
Content-Length: 32038 { StatusCode: 200, Content-Type: "image/x-icon", Accept-Ranges: "bytes", ETag: "[Redacted]", Last-Modified: "Thu, 16 Jun 2022 07:02:55 GMT", Content-Length: "32038", SourceContext: "Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware", RequestId: "0HNC0HP5TD59L:00000023", RequestPath: "/favicon.ico", ConnectionId: "0HNC0HP5TD59L", ThreadId: 25, X_Original_For: null, X_Forwarded_Proto: null, X_Original_Proto: null, X_Forwarded_Host: null, X_Original_Host: null } 

[04/21/2025 12:38:02 +08:00] Information { Id: 2 } IP:::1 CorrelationId:null Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 ContentType:image/x-icon ContentLength:32038 RequestBody: RequestQuery: MemoryUsage:/339099648 Request finished "HTTP/2" "GET" "https"://"[::1]:4433""""/favicon.ico""" - 200 32038 "image/x-icon" 10.8386ms { SourceContext: "Microsoft.AspNetCore.Hosting.Diagnostics", RequestId: "0HNC0HP5TD59L:00000023", RequestPath: "/favicon.ico", ConnectionId: "0HNC0HP5TD59L", ThreadId: 13, X_Original_For: null, X_Forwarded_Proto: null, X_Original_Proto: null, X_Forwarded_Host: null, X_Original_Host: null } 

[JackStrap]

Hi, to correct your error, you need to change how you call the formatter.

Here's an example of my appsettings.json:

{
  "Name": "File",
  "Args": {
    "path": "./logs/logApp.json",
    "formatter": {
      "type": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog"
    },
    "rollingInterval": "Year",
    "shared": true
  }
}

And here's the resulting log output:

{"@timestamp":"2025-06-02T12:19:07.5245655-04:00","log.level":"Information","message":"Starting task in \"DEV\" at: \"2025-06-02T12:19:07.5081417-04:00\"","ecs.version":"8.11.0","log":{"logger":"Elastic.CommonSchema.Serilog"},"labels":{"MessageTemplate":"Starting task in {Environment} at: {DateTime}","Environment":"DEV","DateTime":"2025-06-02T12:19:07.5081417-04:00"},"agent":{"type":"Elastic.CommonSchema.Serilog","version":"8.18.1+420132403778783edc3ead4734c1b1939274ea5c"},"event":{"created":"2025-06-02T12:19:07.5245655-04:00","severity":2,"timezone":"Eastern Standard Time"},"host":{"os":{"full":"Microsoft Windows 10.0.22631","platform":"Win32NT","version":"10.0.22631.0"},"architecture":"X64","hostname":"someHost"},"process":{"name":"someProcess","pid":31672,"thread.id":1,"title":""},"service":{"name":"someService","type":"dotnet","version":"1.0.0+8350c8e61e6fbc1bce3e266461f16c8e72021837"},"user":{"domain":"someDomain","name":"someUser"}}

Hope this helps!

[khteh]

I missed this message. What's "shared": true? My updated config:

        "WriteTo": [
            {
                "Name": "Console",
                "Args": {
                    "formatter": {
                        "type": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog"
                    },                    
                    "outputTemplate": "[{Timestamp}] {Level} {EventId} IP:{ClientIp} CorrelationId:{CorrelationId} Agent:{UserAgent} ContentType:{ContentType} ContentLength:{ContentLength} RequestBody:{RequestBody} RequestQuery:{RequestQuery} MemoryUsage:{MemoryUsageExact}/{MemoryUsage} {Message:j} {Properties} {NewLine}{Exception}{NewLine}"
                }
            },
            {
                "Name": "File",
                "Args": {
                    "path": "/var/log/aspnetcore/log",
                    "formatter": {
                        "type": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog"
                    },                    
                    "outputTemplate": "[{Timestamp}] {Level} {EventId} IP:{ClientIp} CorrelationId:{CorrelationId} Agent:{UserAgent} ContentType:{ContentType} ContentLength:{ContentLength} RequestBody:{RequestBody} RequestQuery:{RequestQuery} MemoryUsage:{MemoryUsageExact}/{MemoryUsage} {Message:j} {Properties} {NewLine}{Exception}{NewLine}",
                    "rollingInterval": "Day",
                    "retainedFileCountLimit": 3
                }
            }
        ]

This is what I get from the "/var/log/aspnetcore/log", still doesn't seem to be JSON:

[07/15/2025 13:09:54 +08:00] Debug { Id: 1, Name: "ReceivedHubInvocation" } IP:::1 CorrelationId:null Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 ContentType:null ContentLength:null RequestBody: RequestQuery:?access_token=eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtaWNrZXkiLCJqdGkiOiIwMTk4MGM3Yi05YjEwLTc0OTgtYjIyYi0zZmJlMTU2NTIyMGEiLCJpYXQiOjE3NTI1NTYwODMsInJvbCI6ImFwaV9hY2Nlc3MiLCJpZCI6IjQ0NjY1MTE4LWVlNjEtNDc5Ny04N2I5LTIyOGY3Zjc4MzI1MCIsIm5iZiI6MTc1MjU1NjA4MywiZXhwIjoxNzUyNTYzMjgzLCJpc3MiOiJ3ZWJBcGkiLCJhdWQiOiJodHRwczovL2xvY2FsaG9zdC8ifQ.hyZR8o8Nx4eq8JfVj7aCgsdS1GbdEGB-t4iwDRmaj6G6fRtvdLc5KmmptZhfN8ql8g39-zdshJ2BQXG4h0CpWw MemoryUsage:8622080/417275904 Received hub invocation: "InvocationMessage { InvocationId: \"0\", Target: \"ReceiveMessageFromUser\", Arguments: [ mickey, asgsdgsag ], StreamIds: [  ] }". { SourceContext: "Microsoft.AspNetCore.SignalR.Internal.DefaultHubDispatcher", TransportConnectionId: "KarX6cQB4SXmmL0kuquCCg", RequestId: "0HNE3BLMKFN4K:0000001F", RequestPath: "/chatHub", ConnectionId: "0HNE3BLMKFN4K", ThreadId: 24, X_Original_For: null, X_Forwarded_Proto: null, X_Original_Proto: null, X_Forwarded_Host: null, X_Original_Host: null } 

[JackStrap]

Hi, I think the problem is with how you're formatting the outputTemplate — it's not the same as the one used in the Console sink.
You can find all available properties here: serilog-expressions

Here’s an example of one I use:

{
  "Name": "File",
  "Args": {
    "path": "./logs/logApp.json",
    "formatter": {
      "type": "Serilog.Templates.ExpressionTemplate, Serilog.Expressions",
      "template": "{ {@timestamp: @t, 'log.level': @l, message: @m, exception: @x} }\n"
    },
    "rollingInterval": "Year",
    "shared": true
  }
}

This will produce output like:

{"@timestamp":"2025-06-13T09:56:07.2772845-04:00","log.level":"Information","message":"Time elapsed: 0 min 55 sec 115 ms"}

Hope this helps!

[khteh]

Seems to work. What's shared: true?