Remove unnecessary objects from Elastic Common Schema logs

221 Views Asked by At

I am using Serilog and Elastic.CommonSchema.Serilog to have console logs with ECS fields in JSON format.

I don't need to have the objects like host, process in the output. How can I remove them?

ENV:

ASP.NET Core 6 / Alpine Linux Container

Code:

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Is(LogEventLevel.Debug)
    .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
    .MinimumLevel.Override("Microsoft.Hosting.Lifetime", LogEventLevel.Information)
    .Enrich.FromLogContext()
    .WriteTo.Async(a => a.Console(new EcsTextFormatter()))
    .CreateLogger();

No any Serilog related modifications in appsettings.json

I'm getting below output.

{
    "@timestamp": "2023-08-16T10:06:24.0917831+00:00",
    "log.level": "Information",
    "message": "xxxx ccccc vvvv",
    "ecs.version": "8.6.0",
    "log": {
        "logger": "xx.yy.ccc.BBBB"
    },
    "labels": {
        "MessageTemplate": "xxxx ccccc vvvv""
    },
    "agent": {
        "type": "Elastic.CommonSchema.Serilog",
        "version": "8.6.1"
    },
    "event": {
        "created": "2023-08-16T10:06:24.0917831+00:00",
        "severity": 2,
        "timezone": "Coordinated Universal Time"
    },
    "host": {
        "os": {
            "full": "aaaa xxx yyy",
            "platform": "vvvv",
            "version": "x.x.x.xx"
        },
        "architecture": "X64",
        "hostname": "xxxx"
    },
    "process": {
        "name": "xxx",
        "pid": 11,
        "thread.id": 4,
        "thread.name": "xxxx",
        "title": ""
    },
    "service": {
        "name": "xxx",
        "type": "xxx",
        "version": "1.0.0"
    },
    "user": {
        "domain": "xxx",
        "name": ""
    }
}
1

There are 1 best solutions below

0
On

You can remove a few parts of the log with some configuration on EcsTextFormatter :

builder.Host.UseSerilog(
        (ctx, config) =>
        {
            var httpAccessor = ctx.Configuration.Get<HttpContextAccessor>();

            config
                .ReadFrom.Configuration(ctx.Configuration)
                .Enrich.WithEcsHttpContext(httpAccessor!)
                .WriteTo.Console(new EcsTextFormatter(new EcsTextFormatterConfiguration
                {
                    IncludeHost = false,
                    IncludeProcess = false,
                    IncludeUser = false
                }));
        });