« NLog Layout Data Shippers »
Elastic Docs › ›Formatters

log4net

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

log4net

edit

This Layout implementation formats a log4net event into a JSON representation that adheres to the Elastic Common Schema specification.

Installation

edit

Add a reference to the Elastic.CommonSchema.Log4net package:

<PackageReference Include="Elastic.CommonSchema.Log4net" Version="8.6.0" />

Usage

edit

Setup using configuration

edit

Specify layout type in appender’s configuration:

<log4net>
    <root>
        <level value="INFO" />
        <appender-ref ref="ConsoleAppender" />
    </root>
    <appender name="ConsoleAppender" type="log4net.Appender.ConsoleAppender">
        <layout type="Elastic.CommonSchema.Log4net.EcsLayout, Elastic.CommonSchema.Log4net" />
    </appender>
</log4net>

Setup programatically

edit
var hierarchy = (Hierarchy)LogManager.CreateRepository(Guid.NewGuid().ToString());
var appender = new ConsoleAppender { Layout = new EcsLayout() }; // Use the ECS layout.
hierarchy.Root.AddAppender(appender);
hierarchy.Root.Level = Level.All;
hierarchy.Configured = true;

The Layout = new EcsLayout() line then instructs log4net to use ECS layout. The sample above uses the console appender, but you are free to use any appender of your choice, perhaps consider using a filesystem target and Elastic Filebeat for durable and reliable ingestion.

ECS Aware Properties

edit

Any valid ECS log template properties that is available under LogTemplateProperties.* e.g LogTemplateProperties.TraceId is supported and will directly set the appropriate ECS field.

Output

edit

Apart from mandatory fields, the output contains additional data:

  • log.origin.file.name is taken from LocationInformation
  • log.origin.file.line is taken from LocationInformation
  • log.origin.function is taken from LocationInformation
  • event.created is taken from timestamp
  • event.timezone is equal to local timezone
  • host.hostname is taken from HostName property
  • process.thread.id is taken from ThreadName if it has numeric value
  • process.thread.name is taken from ThreadName if it doesn’t have numeric value
  • service.name is taken from entry or calling assembly
  • service.version is taken from entry or calling assembly
  • error.message is taken from ExceptionObject
  • error.type is taken from ExceptionObject
  • error.stacktrace is taken from ExceptionObject
  • metadata is taken from properties. It also contains message template and arguments in case a formatted message was logged

Sample log event output (formatted for readability):

{
    "@timestamp": "2022-08-28T14:06:28.5121651+02:00",
    "log.level": "INFO",
    "message": "Hi! Welcome to example!",
    "metadata": {
        "global_property": "Example",
        "message_template": "{0}! Welcome to example!"
        "0": "Hi"
    },
    "ecs": {
        "version": "8.3.1"
    },
    "event": {
        "timezone": "Central European Time",
        "created": "2022-08-28T14:06:28.5121651+02:00"
    },
    "host": {
        "hostname": "HGU780D3"
    },
    "log": {
        "logger": "Elastic.CommonSchema.Log4net.Example.Program",
        "original": null,
        "origin": {
            "file": {
                "name": "C:\\Development\\Elastic.CommonSchema.Log4net.Example\\Program.cs",
                "line": 17
            },
            "function": "Main"
        }
    },
    "process": {
        "thread": {
            "id": 1
        }
    },
    "service": {
        "name": "Elastic.CommonSchema.Log4net.Example",
        "version": "1.0.0.0"
    }
}
« NLog Layout Data Shippers »