我需要向Kibana发送NLog日志消息。现在我使用Nlog.Targets.ElasticSearch和structuredlogging.json,但在这种情况下,弹性将消息视为字符串而不是json。一般来说,我需要Kibana将消息视为对象,我可以通过这些字段进行未来的分析。
那么如何强制nlog或NLog.Targets.ElasticSearch将数据发送到elasticsearch来被视为json?
这就是我现在所拥有的:
{
"_index": "logstash-2017.10.12",
"_type": "logevent",
"_id": "AV8QvCAHXFqCIKUdDl_1",
"_score": 1,
"_source": {
"@timestamp": "2017-10-12T13:18:05.0609218Z",
"level": "Error",
"message": """{"TimeStamp":"2017-10-12T13:18:05.060Z","Level":"Error","LoggerName":"testApp.Program","Message":"error","CallSite":"testApp.Program.Main","error":"error0"}"""
}
}
它需要是这样的:
{
"_index": "logstash-2017.10.12",
"_type": "logevent",
"_id": "AV8QvCAHXFqCIKUdDl_1",
"_score": 1,
"_source": {
"@timestamp": "2017-10-12T13:18:05.0609218Z",
"level": "Error",
"message": {
"TimeStamp":"2017-10-12T13:18:05.060Z",
"Level":"Error",
"LoggerName":"testApp.Program",
"Message":"error",
"CallSite":"testApp.Program.Main",
"error":"error0"
}
}
}
当前的NLog.config看起来如此:
<target name="elastic" xsi:type="BufferingWrapper" flushTimeout="5000" >
<target xsi:type="ElasticSearch" layout="${structuredlogging.json}">
</target>
</target>
答案 0 :(得分:0)
也许这会起作用:
<target name="elastic" xsi:type="BufferingWrapper" flushTimeout="500" >
<target xsi:type="ElasticSearch">
<field name="msg" layout="${structuredlogging.json}" layoutType="System.Object" />
</target>
</target>
您也可以执行此操作(不使用NLog.StructuredLogging.Json):
<target name="elastic" xsi:type="BufferingWrapper" flushTimeout="500" >
<target xsi:type="ElasticSearch" includeAllProperties="true">
<field name="TimeStamp" layout="${date:format=o}" />
<field name="Level" layout="${level}" />
<field name="LoggerName" layout="${logger}" />
<field name="Message" layout="${message}" />
<field name="CallSite" layout="${callsite}" />
<field name="error" layout="${exception:format=tostring}" />
</target>
</target>
答案 1 :(得分:0)
您可以执行以下操作:
<field name="MessageObject" layout="${message}" layoutType="System.Object" />
然后使用以下命令进行记录:
_logger.LogInformation("{@ExampleObject}", exampleLoggingObject);
输出为:
"Message": {
"ExecutionTime": 12,
"Level": "Information",
"Type": "ABC",
....
}