使用Newtonsoft（Json.NET）来序列化System.Diagnostics.EventLogEntry集合

Question

I'm trying to gather windows events that satisfy a particular query and serialize them to JSON so that I can import that collection into a MongoDB database. This is just me practicing and fooling around, but I got stuck at this point and would love to be able to move forward.

The problem:

When I use JsonConvert.SerializeObject(...) , I certainly do get it to serialize something similar to the object in the sense that there are a few properties that survived:

public class EventSerializer
{
    public static void Serialize(EventLogEntry eventLogEntry)
    {
        var traceWriter = new MemoryTraceWriter();
        JsonConvert.SerializeObject(eventLogEntry, Formatting.Indented, new JsonSerializerSettings
        {
            TraceWriter = traceWriter
        });
        Console.WriteLine(traceWriter);
    }
}

Output:

{
    "DataBuffer": "<seemingly-random, long string>",
    "LogName": "Application",
    "MachineName": "<my machine's name>"
}

I can even deserialize the object and get what I expected back. But I really don't want the DataBuffer key-value pair in there, I want the contents of the EventLogEntry to be readable to so that I can parse that information out of MongoDB.

I've been looking through the documentation for Json.NET , and I'm wondering if I need to do something with creating my own Converter or something, but I'm having a little trouble understanding it all from here. There is also talk, in the documentation , of the ability to opt-in/opt-out of serializing particular properties/fields, but it isn't clear to me how one would do that to an object whose declaration/specification wasn't written by one's self.

Any and all help/suggestions are appreciated.

Answer 1

As far as I know, you cannot deserialize JSON into a new EventLogEntry object. One reason is that some the properties in EventLogEntry are read-only properties, and the getters for theses properties contain logic to calculate the values, ie, they are not a simple getters that obtain the value from internally stored field.

I suggest that you create a special object to hold the data. Here is an example:

public class MyEventLogEntry
{
    public string MachineName { get; set; }
    public DateTime GeneratedTime { get; set; }
    public string Message { get; set; }
    public long InstanceId { get; set; } 
}

You can put in this class the event properties that you are interested in. They can even have different names than the ones inside EventLogEntry .

You can use AutoMapper to easily convert from EventLogEntry to MyEventLogEntry . Or you can do it manually if you want.

Here is a code sample that uses AutoMapper:

AutoMapper.Mapper.CreateMap<EventLogEntry, MyEventLogEntry>()
    .ForMember(dst => dst.InstanceId, opt => opt.MapFrom(src => src.InstanceId))
    .ForMember(dst => dst.Message, opt => opt.MapFrom(src => src.Message))
    .ForMember(dst => dst.GeneratedTime, opt => opt.MapFrom(src => src.TimeGenerated))
    .ForMember(dst => dst.MachineName, opt => opt.MapFrom(src => src.MachineName));

EventLog log = new EventLog("Application");

EventLogEntry entry = log.Entries[0];

MyEventLogEntry my_entry = AutoMapper.Mapper.Map<EventLogEntry, MyEventLogEntry>(entry);

string json = JsonConvert.SerializeObject(my_entry);

MyEventLogEntry deserialized_entry = JsonConvert.DeserializeObject<MyEventLogEntry>(json);

Please note that the call to AutoMapper.Mapper.CreateMap needs to done only once (eg at the start of your application).

You can use MyEventLogEntry when you want to read/write from/to the database.