Suffix appended to properties logged through Serilog for dotnet

Question

We're logging to Elastic through the Serilog dotnet package and have noticed that properties that we add to the Poerperties part of the log events seem to be suffixed with _ (underscore) and then some type identifier. For example:

This causes some issues for us in the indexing process. I've been looking through the Serilog library code to try to find the source of this but without any luck. Can someone point me in the right direction as to where the suffix is added to the property names?

Answer 1

It looks like you're overriding the ElasticsearchSinkOptions.CustomFormatter with code to do this when constructing the sink. Using the default formatter (leaving this un-set) should not result in this style of property name.

If this doesn't cover it, please post as much as you can to show how the sink is being configured in your app.

See also:

• https://github.com/serilog-contrib/serilog-sinks-elasticsearch#a-note-about-fields-inside-elasticsearch
• https://github.com/serilog-contrib/serilog-sinks-elasticsearch/issues/184