serilog-contrib / serilog-sinks-graylog Goto Github PK

Hey,

since we want to log to Graylog with Serilog I took a look at your sink and noticed that you are implementing the async handling all by yourself. Have you considered instead simply using the PeriodicBatchingSink already provided by Serilog?

It's intended for sinks like this and would save you the extra work while offering some more features. :)

Cheers
Michael

There is an issue when logger creation is called and the VM is also starting up, there doesn't seem to be network connectivity so the initial dns resolve throws an exception and the service doesn't start.

Application: NotificationService.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Net.Sockets.SocketException
   at System.Net.Dns.HostResolutionEndHelper(System.IAsyncResult)
   at System.Net.Dns.EndGetHostAddresses(System.IAsyncResult)
   at System.Threading.Tasks.TaskFactory`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].FromAsyncCoreLogic(System.IAsyncResult, System.Func`2<System.IAsyncResult,System.__Canon>, System.Action`1<System.IAsyncResult>, System.Threading.Tasks.Task`1<System.__Canon>, Boolean)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at Serilog.Sinks.Graylog.Transport.DnsWrapper+<GetHostAddresses>d__0.MoveNext()

Exception Info: System.AggregateException
   at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean)
   at System.Threading.Tasks.Task`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].GetResultCore(Boolean)
   at System.Threading.Tasks.Task`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Result()
   at Serilog.Sinks.Graylog.GraylogSink..ctor(Serilog.Sinks.Graylog.GraylogSinkOptions)
   at Serilog.Sinks.Graylog.LoggerConfigurationGrayLogExtensions.Graylog(Serilog.Configuration.LoggerSinkConfiguration, Serilog.Sinks.Graylog.GraylogSinkOptions)
   at NotificationService.Infrastructure.Logging.SerilogInitializer.Initialize()
   at NotificationService.Program.Main(System.String[])

Hey @whir1,

we just noticed that boolean values are not sent in a valid GELF format. It's rather valid JSON it appears to me. Let me illustrate with two examples.

Current way how booleans are sent:

{
    "facility": "GELF",
    "full_message": "Boolean value: True",
    "host": "IT-123",
    "level": 6,
    "short_message": "Boolean value: True",
    "timestamp": 1507288877.785,
    "version": "1.1",
    "_stringLevel": "Information",
    "_BoolValue": true
}

How valid GELF should look like:

{
    "facility": "GELF",
    "full_message": "Boolean value: True",
    "host": "IT-123",
    "level": 6,
    "short_message": "Boolean value: True",
    "timestamp": 1507288877.785,
    "version": "1.1",
    "_stringLevel": "Information",
    "_BoolValue": "true"
}

All values must be wrapped in quotes according to the specification. Graylog will simply drop values that do not follow this.

Cheers
Michael

public async void Emit(LogEvent logEvent)
{
try
{
await EmitAsync(logEvent);
}
catch (Exception exc)
{
SelfLog.WriteLine("Oops something going wrong {0}", exc);
}
}

Hi,

I try to add exception enrichment data in my logs, using the following lib: https://github.com/RehanSaeed/Serilog.Exceptions
But it seems the related properties are not sent to Graylog.

I tried to log in a file with a json format and the enrichment is working.
Any reason it doesn't work with Graylog? Am I maybe missing a configuration or something?

Hi,

I'm using version 2.0.9 for sending logs into Elastic logstash server. Logs works fine but I'm missing message_template field in Elastic to support structured logging. Is there any way how to add original message template to be logged in Elastic?

For example:
_logger.LogInformation("Test {TestMessage}.", "HelloWorld");

should log "Test {TestMessage}." into elastic as message_template.

Thanks,
beda

https://github.com/whir1/serilog-sinks-graylog/blob/73e34c0e2827062fa9936dadf77657e3a17def71/src/Serilog.Sinks.Graylog/MessageBuilders/GelfMessageBuilder.cs#L36

This should be using .UtcDateTime instead of .DateTime. DateTime will return an "Unspecified" Kind of of DateTime which when converted using .ToUniversalTime() (on Line 53), it will use the local time zone to convert to Utc. Calling .UtcDateTime from the original DateTimeOffset value on logEvent.Timestamp, we are guaranteed to get the proper Utc date.

Hello. I've seen GELF TCP Inputs support TLS authentication. I need to expose a port to the internet to be able to receive logs from remote systems in a secure way. Does this library support TLS authentication when using TCP protocol?

Something like:

_sslStream.AuthenticateAsClientAsync(_sslHost, certificate, true);

Thanks

Hello,
I'm using this Sink in different applications and I've found the problem that if the Graylog server has a small connection cut and data is just being sent by the TCP client, this Sink is never able to recover that connection and forces us to restart our applications to be able to log again in Graylog.

I will perform a PR to handle TCP client reconnections.

Currently I have the issue that the sink sends messages of severity Debug to Graylog even when I configure minimumLogEventLevel to Information.

My configuration looks like (I have ommitted my real values)
{ "Serilog": { "MinimumLevel": { "Default": "Debug", "Override": { "Microsoft": "Warning", "System": "Warning" } }, "Using": ["Serilog.Sinks.Console", "Serilog.Sinks.Graylog"], "WriteTo": [ { "Name": "Console" }, { "Name": "Graylog", "Args": { "hostnameOrAddress": "0.0.0.0", "port": "00000", "transportType": "Udp", "minimumLogEventLevel ": "Information", "facility": "Development" } } ] } }

Is this the right usage of the *minimumLogEventLevel * or for what purpose should I use this?

I have upgraded from 1.0.7 to 1.0.8 which renders my current setup useless. So no logs arrive at graylog.
This is my serilog configuration section. When i rollback the package "Serilog.Sinks.Graylog.Batching" to 1.0.7 everything works fine. Does anybody else experience this behaviour? Btw. using it in an ASP.NET Core application.

 "Serilog": {
    "Using": [ "Serilog.Sinks.Graylog.Batching", "Serilog.Sinks.Console" ],
    "Properties": {
      "Application": "ReportPortal.Dev"
    },
    "WriteTo": [
      {
        "Name": "Graylog",
        "Args": {
            "BatchSizeLimit": 1000,
            "QueueLimit": 4000,
            "Period": "00:01:00",
            "MinimumLogEventLevel": "Information",
            "HostnameOrAddress": "yyy",
            "Port": "5555",
            "TransportType": "Udp"
        }
      },
      {
        "Name": "Console",
        "Args": {
          "restrictedToMinimumLevel": "Information"
        }
      }
    ]
  }

Hi!

Is it possible to configure the serializer settings? For example if I want to convert my enum parameters to string instead of int

Thanks for your help!

Hi,
As far as I saw, this library supports maximum 8192 byte of udp packet size. This means 128 * 8192 = 1MB total message size can be sent to gralog, correct me if I'm wrong. But our application keeps very big log data that bigger than 1 mb. Can we change MaxMessageSizeInUdp in ChunkSettings?

Hi there, I think it would be great to have a possibility to send messages async. Maybe do it configurable.

Because right now you are sending the message inside a Task, but you are waiting on it to finish.

Which practically makes it sync.

# Serilog.Sinks.Graylog/Transport/Udp/UdpTransportClient.cs

        public void Send(byte[] payload)
        {            
            Task resultTask = Task.Run(() =>
            {
                using (var udpClient = new UdpClient())
                {
                    udpClient.SendAsync(payload, payload.Length, _target);
                }
            });
            resultTask.Wait();
        }

I would love to contribute to it. Maybe we could remove the wait or not according to configuration by user

thanks!

By request @bennybechdk

Hi!

First of all, thanks for a great sink library that is very useful!

I have been running into some issues when running this over WCF services where it created deadlocks when running over TCP and the reason for this is three missing ConfigureAwait(false) calls in the TCPTransportClient.

A fix is in this pull requests.

https://github.com/whir1/serilog-sinks-graylog/pull/64

/Fredrik

This threw us for a loop recently. We had a log line:

logger.LogInformation("Logging {Data}", "foo");
logger.LogInformation("Logging {SomethingElse}", "bar");

For some reason the first line was never logged to Graylog, even though the second one was. After being stumped for a while, my colleague suggested that I should change the message template. It turns out that when I use {Data} in the message template, it fails to log to GELF (over HTTP), but it does log to the file sink. If I instead use {data} it does work.

I had a quick look through the code, and couldn't find any reason for this behaviour, however I might have overlooked something.
Could you have a look at this? Maybe add a unit test? The other option is that our Graylog server is somehow discarding log messages with this template.

Hello!

I experienced some issues with sending logs in my test project. It's just simple console project and last line of code is responsible for sending logs. In most cases logs are not send. I was very confused first time so I investigated sink code and I found this. I think it's because of async void Emit which is basically fire and forget method. According to my knowledge async void is construction designed only for event handlers and in others cases may be not stable. IMHO it should be just void method and logs should be send synchronously but correct me if I'm wrong.

Here are some references:

1. Link
2. Link

I'm happy to help and do some PR but first I want to know your opinion 😄

BTW Thanks for great sink! It's fantastic to use composition of graylog and serilog and it's thanks to your work!

The Verbose level must be greater or at least equal to Debug.

        private static readonly Dictionary<LogEventLevel, int> LogLevelMap = new Dictionary<LogEventLevel, int>
        {
            [LogEventLevel.Verbose] = 5, // wrong! must be 7
            [LogEventLevel.Debug] = 7,
            [LogEventLevel.Information] = 6,
            [LogEventLevel.Warning] = 4,
            [LogEventLevel.Error] = 3,
            [LogEventLevel.Fatal] = 0
        };

RU: Неправильный код для уровня Verbose, это самый подробный уровень, должен быть больше Debug. Можно поправить?

I would like be able to set the "host" property of the GELF message from the configuration.
Currently the host property is given the machine's Dns.Hostname value with no (obvious) way to change it.

edit: I created a PR with all the necessary code implementation.

https://github.com/whir1/serilog-sinks-graylog/blob/513c3be49c01b741695f344d2fbb0b7ec63a6256/src/Serilog.Sinks.Graylog.Core/Extensions/DateTimeExtensions.cs#L16
Hi,
Serilog has already DateTimeOffset which has offset/zone info. But you are converting DateTimeOffset to DateTime and then utc with ToUniversalTime extension method. This cause double calculation of utc time. You can check if you want with these two lines of code:

var utcNow = DateTime.UtcNow;
var incorrectCalculation = new DateTimeOffset(utcNow).DateTime.ToUniversalTime();
var correctCalculation = new DateTimeOffset(utcNow).ToUniversalTime().DateTime;

You should call ToUniversalTime() on DateTimeOffset not the DateTime property of the offset.
So I suggest to change ConvertToNix method to use DateTimeOffset not DateTime.

Emitting logs should be an async processes which extended the functionality provided by
https://github.com/serilog/serilog-sinks-periodicbatching

Hello,

We are having some trouble using the library because in some scenarios the UdpClient gets disposed before the message sending completes.
In the UdpClientTransport class the Send method creates the udpClient instance wrapped in the using directive. The returned Task is not executed and completed instantly resulting in disposing the udpClient instance which is still needed.
The actual result is getting an exception with the message: 'Cannot access a disposed object'.
.......
StackTrace
at System.Net.Sockets.Socket.EndSendTo(IAsyncResult asyncResult)
at System.Net.Sockets.UdpClient.EndSend(IAsyncResult asyncResult)
at System.Threading.Tasks.TaskFactory 1.FromAsyncCoreLogic(IAsyncResult iar, Func 2 endFunction, Action 1 endAction, Task 1 promise, Boolean requiresSynchronization)

The sink is created in code with the received parameters and TransportType.Udp:
new GraylogSink(new GraylogSinkOptions { HostnameOrAdress = host, Port = port, TransportType = TransportType.Udp, Facility = facility });

Could you please take a look into this issue,

Thank you

I am finding that this doesnt seem to work. All event levels get sent to GrayLog:

   {
        "Name": "Graylog",
        "Args": {
          "hostnameOrAddress": "",
          "port": "12201",
          "transportType": "Udp",
          "minimumLogEventLevel": "Error"
        }
      }

Am I missing something?

Hi
First I'd like to appreciate your plugin, really good piece of work.

recently I found that my asp.net core app becomes irresponsive under certain load. Usually it happens around 1000 requests per second.

Quick performance review pointed at:
https://github.com/whir1/serilog-sinks-graylog/blob/6d0e3b930fbeedbb56fd3cdb91790f9957b2f298/src/Serilog.Sinks.Graylog/GraylogSink.cs#L30

After taking Task.Run off ( it was doing CPU based async operation ) everything came into normal state.

Should I consider a PR for that?

I have a micro-service running that used to log to file. I wanted to log these messages to our Graylog instance.

However once I enabled logging over HTTPS to our Graylog instance, the service started to slow down tremendously. Regular requests would suddenly take up to five seconds to complete, instead of fractions of seconds. Do you have any idea what I could have done wrong?

When I remove the Graylog section from the appsettings.json shown below, the speed is back to normal.

In other applications logging to the same Graylog instance's HTTPS endpoint, I have not noticed this slowdown.

appsettings.json

{
  "Serilog": {
    "MinimumLevel": {
      "Default": "Warning",
      "Override": {
        "Microsoft": "Warning",
        "Windows": "Warning"
      }
    },
    "WriteTo": [
      {
        "Name": "Async",
        "Args": {
          "configure": [
            {
              "Name": "Console"
            },
            {
              "Name": "File",
              "Args": {
                "path": "/var/log/TestService/.log",
                "rollingInterval": "Day",
                "retainedFileCountLimit": 30,
                "rollOnFileSizeLimit": true
              }
            },
            {
              "Name": "Graylog",
              "Args": {
                "hostnameOrAddress": "https://graylog.example.org",
                "port": "443",
                "transportType": "Http"
              }
            }
          ]
        }
      }
    ],
    "Properties": {
      "Application": "Test Service"
    }
  },
}

ILspy assembly load log:
// Detected Target-Framework-Id: .NETFramework,Version=v4.6.1

// Referenced assemblies (in metadata order):
// mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
// Assembly reference loading information:
// Info: Success - Found in Assembly List

// Serilog, Version=2.0.0.0, Culture=neutral, PublicKeyToken=24c2f752a8e58a10
// Assembly reference loading information:
// Info: Success - Found in Assembly List

// Serilog.Sinks.Graylog.Core, Version=1.0.0.0, Culture=neutral, PublicKeyToken=48b89c9554032038 (unresolved)
// Newtonsoft.Json, Version=10.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed
// Assembly reference loading information:
// There were some problems during assembly reference load, see below for more information!
// Error: Could not find reference: Newtonsoft.Json, Version=10.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed

After the latest release 2.1.2 which included the #52 , if your Graylog server is not working, for example in a dev environment, there is always a delay when trying to log. I think that trying to log in a sync way is not the best approach...

I see that the log sended to graylog has a template, but I need to send the log with a particular property.

It's possible? Can I set the new property in the appsettings.json?

При следующем коде:
`var loggerConfig = new LoggerConfiguration();

loggerConfig.WriteTo.Graylog(new GraylogSinkOptions{
Facility = "...",
TransportType = TransportType.Udp,
MinimumLogEventLevel = LogEventLevel.Verbose,
HostnameOrAddress = "...",
Port = 12205
});

logger.Information("test");
logger.Debug("test");
logger.Verbose("test");`

На сервер Graylog приходят только сообщения с типом Information, Error, Fatal, Warning

Hi! I think it is very important to log exception type along with the other parameters.

Updated nuget package to v1.5.2 and started to get the parse errors in graylog

Logging using
_logger.LogInformation("Event {@event}", @event);

Event class (with Timestamp)
`public abstract class Event
{
public string EventId { get; set; }
public DateTime Timestamp { get; set; }

    protected Event(string eventId)
    {
        EventId = eventId;
        Timestamp = DateTime.UtcNow;
    }
}`

Error in graylog
{"type":"mapper_parsing_exception","reason":"failed to parse [event_Timestamp]","caused_by":{"type":"illegal_argument_exception","reason":"Invalid format: \"2017-10-17 07:35:41 +00:00\" is malformed at \" 07:35:41 +00:00\""}}

This was working fine previously with v1.5.1.
Downgraded now to v1.5.1 and it started working again.

Any breaking changes in v1.5.2?

Cheers
Björn

Hi,

I am trying to change the default options of batching and they work when I override from code but the configuration is not working. I used below configuration in my project but it stops adding any further logs after adding the first one. Am I doing something wrong here?

"WriteTo": [ { "Name": "Graylog", "Args": { "hostnameOrAddress": "localhost", "port": "2548", "transportType": "Tcp", "batchSizeLimit": 10, "period": 2, "QueueLimit": 1000 } } ]

It seems that the signing of the assembly has gone bad.
It is not possible to load Serilog.Sinks.Graylog.dll in runtime.

Here is a log of the assembly binding:

*** Assembly Binder Log Entry  (2016-11-09 @ 10:12:11) ***

The operation failed.
Bind result: hr = 0x80131045. No description available.

Assembly manager loaded from:  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Running under executable  C:\Users\user\AppData\Local\JetBrains\Installations\ReSharperPlatformVs14_001\JetBrains.ReSharper.TaskRunner.CLR45.x64.exe
--- A detailed error log follows. 

=== Pre-bind state information ===
LOG: DisplayName = Serilog.Sinks.Graylog, Version=1.0.122.0, Culture=neutral, PublicKeyToken=1011d850eeda7898
 (Fully-specified)
LOG: Appbase = file:///C:/Code/CodeProject/bin/Debug
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = C:\Users\user\AppData\Local\Temp\rfbnw15q.3tl\z1lraatr.nm4
LOG: AppName = CodeProject
Calling assembly : CodeProject, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null.
===
LOG: This bind starts in default load context.
LOG: Using application configuration file: C:\Code\CodeProject\bin\Debug\CodeProject.dll.config
LOG: Using host configuration file: 
LOG: Using machine configuration file from C:\Windows\Microsoft.NET\Framework64\v4.0.30319\config\machine.config.
LOG: Post-policy reference: Serilog.Sinks.Graylog, Version=1.0.122.0, Culture=neutral, PublicKeyToken=1011d850eeda7898
LOG: GAC Lookup was unsuccessful.
LOG: Attempting download of new URL file:///C:/Code/CodeProject/bin/Debug/Serilog.Sinks.Graylog.DLL.
LOG: Assembly download was successful. Attempting setup of file: C:\Code\CodeProject\bin\Debug\Serilog.Sinks.Graylog.dll
LOG: Entering download cache setup phase.
LOG: Assembly Name is: Serilog.Sinks.Graylog, Version=1.0.122.0, Culture=neutral, PublicKeyToken=1011d850eeda7898
ERR: Setup failed with hr = 0x80131045.
ERR: Failed to complete setup of assembly (hr = 0x80131045). Probing terminated.

And here's the result with the Strong Name Utility:

C:\Code\CodeProject\bin\Debug>sn -v Serilog.Sinks.Graylog.dll

Microsoft (R) .NET Framework Strong Name Utility  Version 4.0.30319.0
Copyright (c) Microsoft Corporation.  All rights reserved.

Failed to verify assembly -- Strong name validation failed.

Attempted on Windows 8 x64, .NET Framework 4.6.2, Serilog.Sinks.Graylog 1.3.0.

Не кладётся в контекст пользовательские структуры, добавленные через LogContext.PushProperty

Пример кода из linqpad:

void Main()
{
	Log.Logger = new LoggerConfiguration()
					.ReadFrom.AppSettings()
					.CreateLogger();

	using (LogContext.PushProperty("FooValue", new Foo(2), true))
	using (LogContext.PushProperty("BarValue", new Bar(3), true))
	{
		Log.Information("hello world!");
	}		
}

// Define other methods and classes here
public struct Foo
{
	public string A {get;}
	public Foo(int i)
	{
		A = "fafa";
	}
}

public struct Bar
{
	public Foo Foo {get;}
	
	public string Zar {get;}
	
	public Bar(int i)
	{
		Foo = new Foo(2);
		Zar = "fooBar";
	}
}

и в AppConfig

  <appSettings>
    <add key="serilog:minimum-level" value="Verbose" />
    <add key="serilog:using:Graylog" value="Serilog.Sinks.Graylog" />
    <add key="serilog:write-to:Graylog.minimumLogEventLevel" value="Information" />
    <add key="serilog:write-to:Graylog.hostnameOrAddress" value="example.com" />
    <add key="serilog:write-to:Graylog.port" value="12201" />
    <add key="serilog:write-to:Graylog.transportType" value="Udp" />
    <add key="serilog:write-to:Graylog.facility" value="Debug" />
  </appSettings>

А на скрине ниже то, что приходит в graylog

Использую:

• Serilog 2.9.0
• Serilog.Sinks.Graylog 2.1.2
• Serilog.Settings.AppSettings 2.2.2

Hello!

I'm having this trouble and I'm not sure if it is indeed an issue.

Every log I get on Graylog (running on localhost btw) is with UTC 0 format, but logfiles and console have my local timezone (this is what I want actually).

Is this something related to graylog damanding UTC 0? or may be an issue on the sink?

This is my Serilog configuration:

"Serilog": {
   "Using": [ "Serilog.Sinks.Graylog", "Serilog.Sinks.File", "Serilog.Sinks.Console" ],
   "MinimumLevel": {
     "Default": "Debug",
     "Override": {
       "Microsoft": "Warning",
       "System": "Warning"
     }
   },
   "WriteTo": [
     {
       "Name": "Graylog",
       "Args": {
         "MinimumLogEventLevel": "Information",
         "hostnameOrAddress": "127.0.0.1",
         "port": "12201",
         "transportType": "Tcp",
         "restrictedToMinimumLevel": "Information",
         "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level}] #{ThreadId} {Message:lj}{NewLine}{Properties}{NewLine}{Exception}{NewLine}"
       }
     },
     {
       "Name": "File",
       "Args": {
         "restrictedToMinimumLevel": "Information",
         "rollingInterval": 3, //RollingInterval.Day
         "path": "logs/log-.txt",
         "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level}] #{ThreadId} {Message:lj}{NewLine}{Properties}{NewLine}{Exception}{NewLine}"
       }
     },
     {
       "Name": "Console",
       "Args": {
         "restrictedToMinimumLevel": "Information",
         "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level}] #{ThreadId} {Message:lj}{NewLine}{Properties}{NewLine}{Exception}{NewLine}"
       }
     }

   ],
   "Enrich": [ "FromLogContext", "WithMachineName", "WithThreadId" ],
   "Properties": {
     "Application": "app"
   }
 } 

I've been using middleware to add logging context to Graylog using LogContext.PushProperty("name", value) in .net 5 without issue.
I've upgraded to .Net6, and now it does not work any more. It still works with file & console loggers, just not with this one.

Is this an issue anyone else has encountered?

I'm trying to use this sink in a .NET Core application, but I get this exception when I turn on Serilog.Debugging.SelfLog.Enable(msg => Console.WriteLine(msg)); (And no messages sent to Graylog):

2018-09-07T13:00:53.4534320Z Oops something going wrong System.InvalidOperationException: The current SynchronizationContext may not be used as a TaskScheduler.
   at System.Threading.Tasks.SynchronizationContextTaskScheduler..ctor()
   at Serilog.Sinks.Graylog.GraylogSink.Emit(LogEvent logEvent)

Reproduction gist

Environment:

• OS: macOS High Sierra 10.13.6
  • and docker in a vm
  • and windows 10 in a vm
• .NET Core 2.1

Project file:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp2.1</TargetFramework>
    <RootNamespace>test_dotnet_core</RootNamespace>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Serilog" Version="2.7.1" />
    <PackageReference Include="Serilog.Sinks.Console" Version="3.1.1" />
    <PackageReference Include="Serilog.Sinks.Graylog" Version="2.0.2" />
  </ItemGroup>

</Project>

I see that timestamp rounding in GELF is 3
https://github.com/whir1/serilog-sinks-graylog/blob/51c5f255729eb3e5dd5615f238f8456cc19bbe14/src/Serilog.Sinks.Graylog.Core/Extensions/DateTimeExtensions.cs#L17

Is this enough value? we have wrong sorting when logging.
Example:

 _logger.LogDebug("1");
 _logger.LogDebug("2");
 _logger.LogDebug("3");
 _logger.LogDebug("4");
 _logger.LogDebug("5");
 _logger.LogDebug("6");
 _logger.LogDebug("7");
 _logger.LogDebug("8");
 _logger.LogDebug("9");
 _logger.LogDebug("10");

Maybe value ​​can be increased or customizable?

by request @bennybechdk

Please update depency Newtonsoft.Json to version 12.0.x

See related existing issue

The following error is generated when logging to Graylog 2.3

org.graylog2.inputs.codecs.GelfCodec - GELF message <5f889691-813b-11e7-8963-02420aff000e> (received from <10.255.0.17:55268>) has invalid "timestamp": 2017-08-14T17:56:06.3566296 (type: STRING)

Submitted fix PR

Необходимо изменить Using: [ "Serilog.Sinks.Graylog" ] на Using: [ "Serilog.Sinks.Graylog.Core" ]

Map LogLevel to Syslog levels because graylog using syslog log levels

we are missing the certificate option in TcpTransport, I don't want to install the certificate on my machine, here is what I am doing in Graylog, but my company wants to use your package.

` X509Certificate2 certificate2 = new X509Certificate2("C:/Developer/Shared/test.pfx","");
X509Certificate2Collection certificates = new X509Certificate2Collection(new X509Certificate2[] { certificate2});

            await _sslStream.AuthenticateAsClientAsync(_sslHost, certificates, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false).ConfigureAwait(false);
            X509Certificate remoteCertificate = _sslStream.RemoteCertificate;`

The sink won't send any messages to graylog. Graylog is working fine with other sources. The input is setup correctly. When I try to log with Serilog.Sinks.Graylog then wireshark won't capture any packets. So I'm kinda lost at this point. What is the way to troubleshoot the sink?

var logConfig = new LoggerConfiguration()
                .MinimumLevel.Verbose()
                .Destructure.With<SensitiveDataDestructuringPolicy>()
                .Enrich.WithCorrelationId()
                .Destructure.ToMaximumDepth(4)
                .Destructure.ToMaximumStringLength(100)
                .Destructure.ToMaximumCollectionCount(20)
                .WriteTo.Graylog(new GraylogSinkOptions
                {
                    Host = "127.0.0.1",
                    Port = 12201,
                    TransportType = TransportType.Udp // also tried TCP and HTTP
                });

When I send a message per nc it works just fine

echo -e '{"version": "1.1","host":"localhost","short_message":"Hello World","full_message":"Hello World","level":1}\0' | nc -u -w 1 127.0.0.1 12201 

I am using 2.0 version of this library for my Asp.Net 4.5.1 project. I am trying to send my logs to our company server which has specific streams for each application in the company. I couldn't achieve to see my logs on the server dashboard.

Here my code.

_logger = new LoggerConfiguration()
        .WriteTo.Graylog(new GraylogSinkOptions {
            HostnameOrAddress = "server",
            Port =port,
            TransportType = TransportType.Udp
       })
        //.Enrich.WithProperty("LogSource", "applicationName")
           .Enrich.WithProperty("AdditionalFields" , new { application = "applicationName" })
           .MinimumLevel.Information()
           .CreateLogger();

I am not sure but Graylog GELF specification expects an applicationName for the stream, how can I send these additional fields via this (Serilog graylog) extension? (Tried with Enrich api but not worked)

Hi,

It took me a moment to figure out why a lot of logs were missing in Graylog and I finally found that this is because of the default queue size limit (10)

because of that, if you send more than 10 log events, only the first 10 are added in the queue and the other events are lost.

Is there a reason for a so small value? If I take another implementation (https://github.com/serilog/serilog-sinks-azuretablestorage/blob/master/src/Serilog.Sinks.AzureTableStorage/Sinks/AzureTableStorageWithProperties/AzureBatchingTableStorageWithPropertiesSink.cs) the don't use the constructor with the queueLimit parameter. Which means no size limit.