elasticsearch - "Message"字段不是由 Serilog ElasticSearch 接收器发送

Question

我将应用程序配置为将日志发送到 Elasticsearch 。我用https://www.elastic.co/cloud/ 一切似乎都工作正常，除了一件事:日志似乎没有“消息”字段(messageTemplate 在那里)。我检查了 fiddler，似乎发布 json 的请求缺少这个字段，所以我假设问题出在库中的某个地方。有谁知道可能是什么原因吗？

发送到弹性的 json 示例:

{"index":{"_type":"_doc","_index":"logstash-2021.11.08"}}
{"@timestamp":"2021-11-08T19:53:37.5417821+02:00","level":"Information","messageTemplate":"Started notification {Notification}","fields":{"Notification":"SendResetPasswordNotification","SourceContext":"****LoggingMediator","ActionId":"59629d88-ab88-476f-a258-8d984142b223","ActionName":"*****AccountController.SendReset)","RequestId":"0HMD2S2FGO4IP:00000001","RequestPath":"/api/v1/account/sendReset","SpanId":"|565f9fbf-466b083f5ac1a8f5.","TraceId":"565f9fbf-466b083f5ac1a8f5","ParentId":"","ConnectionId":"0HMD2S2FGO4IP","Client":null,"CorrelationId":"a892d398-6a79-47a4-aaf7-d83e12cbd468","Application":"****.Identity.Api","Version":"1.0.0.0","Environment":"Dev"}}

配置:

"Serilog": {
    "Using": [
        "Serilog.Sinks.ElasticSearch"
    ],
    "Enrich": [
        "FromLogContext"
    ],
    "MinimumLevel": {
        "Default": "Debug",
        "Override": {
            "Microsoft": "Warning",
            "System": "Error",
            "Microsoft.Hosting.Lifetime": "Information"
        }
    },
    "WriteTo": [
        {
            "Name": "Elasticsearch",
            "Args": {
                "nodeUris": "url to elastic",
                "autoRegisterTemplate": true,
                "autoRegisterTemplateVersion": "ESv7",
                "customFormatter": "Serilog.Formatting.Elasticsearch.ExceptionAsObjectJsonFormatter, Serilog.Formatting.Elasticsearch"
            }
        }
    ]
}

Answer 1

原因是默认情况下 Serilog.Formatting.Elasticsearch.ExceptionAsObjectJsonFormatter 将 renderMessage 标志设置为 false。解决方案是创建从 ExceptionAsObjectJsonFormatter 派生的自定义格式化程序，并将构造函数中的 renderMessage 标志设置为 true