我们的dotnet核心应用程序使用serilog以json格式吐出日志文件,我们使用beats / logstash / ES来处理。
默认情况下使用messageTemplate字段,该字段使用参数并将值存储在其他地方,如下所示{ConnectionId}。
有没有办法让它有一个包含实际信息的字段? 例如:“连接ID 0HLDSOA7JG3GS发送FIN。”
{
"source" => "/var/log/myapp/myapp-api-logs /myapp-staging-api-logs-20180518.log",
"json" => {
"Properties" => {
"ConnectionId" => "0HLDSOA7JG3GS" ,
"EventId" => {
"Id" => 7
},
"SourceContext" => "Microsoft.AspN etCore.Server.Kestrel.Transport.Libuv"
},
"Level" => "Debug",
"Timestamp" => "2018-05-18T16:23 :40.5286099+03:00",
"MessageTemplate" => "Connection id \" {ConnectionId}\" sending FIN.",
"message" => ""
},
"beat" => {
"hostname" => "33eb9c70141c",
"name" => "33eb9c70141c",
"version" => "6.2.4"
},
"@timestamp" => 2018-05-18T13:23:43.999Z,
"prospector" => {
"type" => "log"
},
"offset" => 55337,
"fields" => {
"appenv" => "staging",
"appsource" => "myapp-staging-api-logs"
},
"@version" => "1",
"host" => "33eb9c70141c",
"tags" => [
[0] "beats_input_raw_event"
]
}