serilog是输出到文件和elasticsearch的最佳方法

tjjdgumg  于 2021-06-14  发布在  ElasticSearch
关注(0)|答案(1)|浏览(448)

我曾经通过filebeat logstash管道将数据发送到elasticsearch。处理通过log4net创建的日志,对它们进行变异,并将必需字段发送到elastic。现在我想通过移除filebeat和logstash来替换我的逻辑,并使用serilog和它的elasticsearch sink。为了更广泛的了解,我有一个api端点,它接收我需要记录到文本文件的请求,因此我需要一个 File Flume。在代码的后面,我的业务逻辑将使用接收到的数据,并创建一个对象,然后我需要将该对象以弹性的方式摄取到索引中。有一个serilog示例并使用某种过滤,或者有两个serilog示例,最好的方法是什么?我更接近于装饰(丰富)我的案例,然后通过过滤(一个serilog示例)使用接收器,但因为我是serilog的新手,所以我不知道如何设置整个过程。
缩写代码如下,我的控制器类:

public class RequestController : ControllerBase
{
    private readonly BLService _service = new BLService(Log.Logger);

    [Route("Test")]
    [HttpPost]
    public IActionResult Test([FromBody]SampleRequest request)
    {
        var logId = Guid.NewGuid().ToString();
        using (LogContext.PushProperty("LogId", logId))
            Log.Information("{@request}", request);

        var tran = new SampleTran
        {
            SampleTranType = "Test",
            SampleTranId = request.Id,
            EventTime = DateTime.Now
        };

        _service.ProcessTransaction(tran);

        return new OkResult();
    }
}

和我的服务,我在那里添加属性 "Type" 定值 "ElkData" 然后我可以过滤:

public class BLService
{
    private readonly ILogger _log;

    public BLService(ILogger logger)
    {
        _log = logger.ForContext("Type", "ElkData");
    }

    public void ProcessTransaction(SampleTran transaction)
    {
        var elkData = DoSomeStuffAndReturnElkTransactionToStore(transaction);
        _log.Information("{@ElkData}", elkData );
    }
}

注意,我的文本文件应该只包含原始请求(没有elasticsearch数据)。到目前为止,我写的所有文件,我的 appsettings.json 看起来像这样:

{
  "Serilog": {
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft": "Warning",
        "Microsoft.Hosting.Lifetime": "Warning",
        "System": "Warning"
      }
    },
    "WriteTo": [
      {
        "Name": "File",
        "Args": {
          "path": "C:\\DEV\\Logs\\mylog-.txt",
          "rollingInterval": "Day",
          "outputTemplate": "{Timestamp:yyyy-MM-ddTHH:mm:ss.fff zzz} [{Level:u3}] {Message:j}{NewLine}{Exception}"
        }
      }
    ],
    "Enrich": [ "FromLogContext" ]
  },
  "AllowedHosts": "*"
}

我需要使用过滤添加弹性部分,对吗?任何帮助都将不胜感激。

trnvg8h3

trnvg8h31#

以下是我如何做到我需要的:我用了 ForContext 以丰富我的日志项目。所以在控制器中,我使用:

var requestLog = Log.ForContext("Type", "Request");
requestLog.Information("Request: {@request}", request);//this needs to go to the log file

blservice中的代码保持不变,过滤在 appsettings.json 作为:

{
  "Serilog": {
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft": "Warning",
        "Microsoft.Hosting.Lifetime": "Warning",
        "System": "Warning"
      }
    },
    "WriteTo": [
      {
        "Name": "Logger",
        "Args": {
          "configureLogger": {
            "Filter": [
              {
                "Name": "ByExcluding",
                "Args": {
                  "expression": "Type = 'ElkData'"
                }
              }
            ],
            "WriteTo": [
              {
                "Name": "File",
                "Args": {
                  "path": "C:\\DEV\\Logs\\mylog-.txt",
                  "rollingInterval": "Day",
                  "outputTemplate": "{Timestamp:yyyy-MM-ddTHH:mm:ss.fff zzz} [{Level:u3}] {Message:j}{NewLine}{Exception}",
                  "shared": true
                }
              }
            ]
          }
        }
      },
      {
        "Name": "Logger",
        "Args": {
          "configureLogger": {
            "Filter": [
              {
                "Name": "ByIncludingOnly",
                "Args": {
                  "expression": "Type = 'ElkData'"
                }
              }
            ],
            "WriteTo": [
              {
                "Name": "Elasticsearch",
                "Args": {
                  "nodeUris": "<your elastic url>",
                  "TypeName": "_doc",
                  "IndexFormat": "serilog_data",
                  "InlineFields":  true,
                  "BufferBaseFilename": "C:\\DEV\\Logs\\elk_buffer"
                }
              }
            ]
          }
        }
      }
    ]
  }
}

因此,该文件将包含所有已注销的内容,除了带有 "Type = 'ElkData'" 丰富,这些将结束在ElasticSearch索引。
希望这个简单的方法有一天能帮助一些serilog新手

相关问题