[英]Using Nlog logger with ECS layout, in kibana the json object appear as a string instead of multiple properties
I'm working on some .Net framework application and i've been asked to send the logs to elasticsearch using kibana as the UI.我正在开发一些 .Net 框架应用程序,我被要求使用 kibana 作为 UI 将日志发送到 elasticsearch。 To have something that is standardized i have to implement ECS (Elastic Common Schema).
要拥有标准化的东西,我必须实施 ECS(弹性通用架构)。
Looking at the example we have on ECS github we only have to implement it on the following way:查看我们在 ECS github上的示例,我们只需按以下方式实现它:
Instead of sending to console, like we have on the example i send it to elastic search而不是发送到控制台,就像我们在示例中那样,我将它发送到弹性搜索
The output from it, would be a nice Json object...它的输出,将是一个不错的 Json 对象......
Maybe it is expected that on kibana we would see something like the following ( Kibana
- Discover
):也许可以预期在 kibana 上我们会看到如下内容(
Kibana
- Discover
):
Looking at that, probably the Json Object is supposed to be treated as a string and everything goes inside the message
property, but that is not what i'm looking for, i want that json to be divided in many properties.看着这一点,可能 Json 对象应该被视为一个字符串,并且所有内容都在
message
属性中,但这不是我要找的,我希望将该 json 划分为许多属性。
Since i'm new to Elastic stack world, i've tried to create a template inside the Index Management
page and the performing there manual mappings like message._metadata.url
to not treat some properties as part of the string but without success.由于我是 Elastic Stack 世界的新手,因此我尝试在“
Index Management
页面中创建一个模板,并在那里执行手动映射,例如message._metadata.url
以不将某些属性视为字符串的一部分,但没有成功。
I'm having trouble finding useful information to solve this problem, can anyone give an hint?我在找到解决这个问题的有用信息时遇到了麻烦,谁能给个提示?
UPDATE:更新:
I found the property enableJsonLayout="true"
that we can put on the target of Nlog
that indeed turns whats on the Json layout as properties on ElasticSearch which is good.我发现属性
enableJsonLayout="true"
我们可以放在Nlog
的目标上,它确实将 Json 布局上的内容作为 ElasticSearch 上的属性,这很好。
Is this the right way to use ECS?这是使用 ECS 的正确方法吗? How can i add aditional properties?
如何添加其他属性?
When you enable this enableJsonLayout="true"
then it means that the configured Layout has to handle everything.当您启用此
enableJsonLayout="true"
这意味着配置的布局必须处理所有内容。 For EcsLayout then you can find the documentation here:对于 EcsLayout 那么你可以在这里找到文档:
https://github.com/elastic/ecs-dotnet/tree/master/src/Elastic.CommonSchema.NLog https://github.com/elastic/ecs-dotnet/tree/master/src/Elastic.CommonSchema.NLog
EcsLayout will by default include all LogEvent Properties as metadata.默认情况下,EcsLayout 将包含所有 LogEvent 属性作为元数据。 See alsohttps://github.com/NLog/NLog/wiki/How-to-use-structured-logging
另见https://github.com/NLog/NLog/wiki/How-to-use-structured-logging
But you can explicit add extra metadata-items:但是您可以显式添加额外的元数据项:
<layout xsi:type="EcsLayout">
<metadata name="MyProperty" layout="MyPropertyValue" />
</layout>
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.