Elastic.Serilog.Sinks

Add a reference to the Elastic.Serilog.Sinks package:

<PackageReference Include="Elastic.Serilog.Sinks" Version="8.6.0" />

There’s a few ways that you can extend a Serilog LoggerConfiguration:

Log.Logger = new LoggerConfiguration()
	.MinimumLevel.Debug()
	.Enrich.FromLogContext()

NOTE: Don’t forget we also publish an Elastic.Apm.SerilogEnricher for the Elastic APM Agent!

Writing to Elasticsearch

.WriteTo.Elasticsearch(new [] { new Uri("http://localhost:9200" )}, opts =>
{
	opts.DataStream = new DataStreamName("logs", "console-example", "demo");
	opts.BootstrapMethod = BootstrapMethod.Failure;
	opts.ConfigureChannel = channelOpts =>
	{
		channelOpts.BufferOptions = new BufferOptions
		{
			ConcurrentConsumers = 10
		};
	};
}, transport =>
{
	// transport.Authentication(new BasicAuthentication(username, password)); // Basic Auth
	// transport.Authentication(new ApiKey(base64EncodedApiKey)); // ApiKey
})

Writing to Elastic Cloud:

.WriteTo.ElasticCloud("cloudId", "cloudUser", "cloudPass", opts =>

opts is an instance of ElasticsearchSinkOptions with the following options

Note that you can also pass ElasticsearchSinkOptions directly

.WriteTo.Elasticsearch(new ElasticsearchSinkOptions(client.Transport))

This allows you to reuse the Transport used by the Elasticsearch Client for instance.

When Elasticsearch security features are enabled, requests without a valid authentication header will be rejected. You can enable authentication via one of the methods below:

Basic Auth

.WriteTo.Elasticsearch(new [] { new Uri("http://localhost:9200" )}, opts =>
{
	...
}, transport =>
{
	transport.Authentication(new BasicAuthentication(username, password)); 
})

API Key

.WriteTo.Elasticsearch(new [] { new Uri("http://localhost:9200" )}, opts =>
{
	...
}, transport =>
{
	transport.Authentication(new ApiKey(base64EncodedApiKey)); 
})

To learn more about authentication with the Elastic Stack, see User Authentication.

This sink by proxy of its formatter allows you to set ECS fields directly from the message template using properties that adhere to the https://messagetemplates.org/ format.

The available ECS message template properties are listed under LogTemplateProperties.* e.g LogTemplateProperties.TraceId

Log.Information("The time is {TraceId}", "my-trace-id");

Will override trace.id on the resulting ECS json document.

In case of issues, you can enable the [Serilog Self-Log feature](https://github.com/serilog/serilog/wiki/Debugging-and-Diagnostics#selflog) to expose any error you might have encountered.