Elastic.CommonSchema.Serilog 8.6.0

Elastic Common Schema Serilog Text Formatter

This ITextFormatter implementation formats a Serilog event into a JSON representation that adheres to the Elastic Common Schema specification.

Packages

The .NET assemblies are published to NuGet under the package name Elastic.CommonSchema.Serilog

How to Enable

var logger = new LoggerConfiguration()
                .WriteTo.Console(new EcsTextFormatter())
                .CreateLogger();

In the code snippet above new EcsTextFormatter() enables the text formatter and instructs Serilog to format the event as JSON. The sample above uses the Console sink, but you are free to use any sink of your choice, perhaps consider using a filesystem sink and Elastic Filebeat for durable and reliable ingestion.

In ASP.NET (core) applications

.UseSerilog((ctx, config) =>
{
	// Ensure HttpContextAccessor is accessible
	var httpAccessor = ctx.Configuration.Get<HttpContextAccessor>();

	config
		.ReadFrom.Configuration(ctx.Configuration)
		.Enrich.WithEcsHttpContext(httpAccessor)
		.WriteTo.Async(a => a.Console(new EcsTextFormatter()));
})

The WithEcsHttpContext ensures logs will be enriched with HttpContext data.

An example of the output is given below:

{
  "@timestamp": "2019-11-22T14:59:02.5903135+11:00",
  "log.level": "Information",
  "message": "Log message",
  "ecs": {
    "version": "1.4.0"
  },
  "event": {
    "severity": 0,
    "timezone": "AUS Eastern Standard Time",
    "created": "2019-11-22T14:59:02.5903135+11:00"
  },
  "log": {
    "logger": "Elastic.CommonSchema.Serilog"
  },
  "process": {
    "thread": {
      "id": 1
    },
    "executable": "System.Threading.ExecutionContext"
  }
}

Configuration

Option Description
MapCurrentThead true map ecs.process by looking up the Process from the current thread
MapHttpAdapter null a way to map HttpContextAccessor to ECS fields.
LogEventsPropertiesToFilter A Set<string> of properties that should not be emitted as labels.* or metadata.*
MapCustom A Func that allows you to mutate the EcsDocument before its fully converted.

ECS Aware Message Templates

This formatter also allows you to set ECS fields directly from the message template using properties that adhere to the https://messagetemplates.org/ format.

The available ECS message template properties are listed under LogTemplateProperties.* e.g LogTemplateProperties.TraceId

Log.Information("The time is {TraceId}", "my-trace-id");

Will override trace.id on the resulting ECS json document.

This software is Copyright (c) 2014-2020 by Elasticsearch BV.

This is free software, licensed under: The Apache License Version 2.0.

Showing the top 20 packages that depend on Elastic.CommonSchema.Serilog.

Packages Downloads
Elastic.Serilog.Sinks
Package Description
 4
Elastic.Serilog.Sinks
Package Description
 3
Elastic.Serilog.Sinks
Package Description
 2

https://github.com/elastic/ecs-dotnet/releases

.NET Framework 4.6.1

.NET Standard 2.0

.NET Standard 2.1

Version Downloads Last updated
8.18.1 4 06/02/2025
8.12.3 18 12/13/2024
8.12.2 21 10/26/2024
8.12.1 18 10/26/2024
8.12.0 19 10/26/2024
8.11.1 33 06/11/2024
8.11.0 21 06/08/2024
8.6.1 16 01/08/2024
8.6.0 19 06/13/2023
8.4.0-alpha4 21 06/13/2023
8.4.0-alpha3 21 06/13/2023
8.4.0-alpha2 21 06/12/2023
8.4.0-alpha1 21 06/12/2023
1.6.0-alpha1 18 06/13/2023
1.5.3 30 06/28/2022
1.5.1 19 06/13/2023
1.5.0 17 06/14/2023
1.4.4 16 06/13/2023
1.4.3 17 06/13/2023
1.4.2 19 06/13/2023
1.4.1 17 02/16/2024
1.4.0 17 06/13/2023
1.4.0-beta1 19 02/16/2024