elasticsearchserilogserilog-sinks-elasticsearch

"Message" field is not send by Serilog ElasticSearch sink


I configured application to send logs to elastic search. I use https://www.elastic.co/cloud/ Everything seems to work fine except one thing: logs appear to not have "message" field (messageTemplate is there). I checked fiddler and it seems that request that posts json lacks this field, so I assume the issue is in library somewhere. Does anyone know what can be a reason?

Example of json sent to elastic:

{"index":{"_type":"_doc","_index":"logstash-2021.11.08"}}
{"@timestamp":"2021-11-08T19:53:37.5417821+02:00","level":"Information","messageTemplate":"Started notification {Notification}","fields":{"Notification":"SendResetPasswordNotification","SourceContext":"****LoggingMediator","ActionId":"59629d88-ab88-476f-a258-8d984142b223","ActionName":"*****AccountController.SendReset)","RequestId":"0HMD2S2FGO4IP:00000001","RequestPath":"/api/v1/account/sendReset","SpanId":"|565f9fbf-466b083f5ac1a8f5.","TraceId":"565f9fbf-466b083f5ac1a8f5","ParentId":"","ConnectionId":"0HMD2S2FGO4IP","Client":null,"CorrelationId":"a892d398-6a79-47a4-aaf7-d83e12cbd468","Application":"****.Identity.Api","Version":"1.0.0.0","Environment":"Dev"}}

Configuration:

"Serilog": {
    "Using": [
        "Serilog.Sinks.ElasticSearch"
    ],
    "Enrich": [
        "FromLogContext"
    ],
    "MinimumLevel": {
        "Default": "Debug",
        "Override": {
            "Microsoft": "Warning",
            "System": "Error",
            "Microsoft.Hosting.Lifetime": "Information"
        }
    },
    "WriteTo": [
        {
            "Name": "Elasticsearch",
            "Args": {
                "nodeUris": "url to elastic",
                "autoRegisterTemplate": true,
                "autoRegisterTemplateVersion": "ESv7",
                "customFormatter": "Serilog.Formatting.Elasticsearch.ExceptionAsObjectJsonFormatter, Serilog.Formatting.Elasticsearch"
            }
        }
    ]
}

Solution

  • So reason was that by default Serilog.Formatting.Elasticsearch.ExceptionAsObjectJsonFormatter has renderMessage flag set to false. The solution was to create custom formatter derived from ExceptionAsObjectJsonFormatter and set renderMessage flag in constructor to true