Serilog not logging to ElasticSearch server and throwing exception

user_2344023 0
Viewed 1284

I am trying to start logging in ElasticSearch but no logs are found in the server and if I enable the diagnostics mode an exception is raised:

That's how my Startup.cs looks:

            //ElasticSearch Logs
        Log.Logger = new LoggerConfiguration()
         .Enrich.FromLogContext()
         .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri("https://myserver.com:9243/"))
         {
             ModifyConnectionSettings = x => x.BasicAuthentication("elastic", "mypassword"),
             AutoRegisterTemplate = true,                 
         })
         .Enrich.FromLogContext()
         .WriteTo.Console()
        .CreateLogger();

The following is my Program.cs

        public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>()
                .UseSerilog();
            });

This is what I have inside a controller:

        _logger.LogError(new Exception("test"), "An error has occurred.");
        _logger.LogInformation("The {User} has just executed {Action}.", "username", "actionName");

        Log.Error("this is my first log");

The exception I am getting:

2021-08-19T21:09:15.2793348Z Failed to create the template. Elasticsearch.Net.ElasticsearchClientException: Request failed to execute. Call: Status code 400 from: PUT /_template/serilog-events-template. ServerError: Type: mapper_parsing_exception Reason: "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [default : {dynamic_templates=[{numerics_in_fields={match_pattern=regex, path_match=fields.[\d+]$, mapping={norms=false, index=true, type=text}}}, {string_fields={mapping={norms=false, index=true, type=text, fields={raw={ignore_above=256, index=true, type=keyword}}}, match_mapping_type=string, match=}}], properties={message={index=true, type=text}, exceptions={type=nested, properties={ExceptionMessage={type=object, properties={MemberType={type=integer}}}, StackTraceString={index=true, type=text}, HResult={type=integer}, RemoteStackTraceString={index=true, type=text}, RemoteStackIndex={type=integer}, Depth={type=integer}}}}}]" CausedBy: "Type: mapper_parsing_exception Reason: "Root mapping definition has unsupported parameters: [default : {dynamic_templates=[{numerics_in_fields={match_pattern=regex, path_match=fields.[\d+]$, mapping={norms=false, index=true, type=text}}}, {string_fields={mapping={norms=false, index=true, type=text, fields={raw={ignore_above=256, index=true, type=keyword}}}, match_mapping_type=string, match=}}], properties={message={index=true, type=text}, exceptions={type=nested, properties={ExceptionMessage={type=object, properties={MemberType={type=integer}}}, StackTraceString={index=true, type=text}, HResult={type=integer}, RemoteStackTraceString={index=true, type=text}, RemoteStackIndex={type=integer}, Depth={type=integer}}}}}]"" at Elasticsearch.Net.Transport1.HandleElasticsearchClientException(RequestData data, Exception clientException, IElasticsearchResponse response) at Elasticsearch.Net.Transport1.FinalizeResponse[TResponse](RequestData requestData, IRequestPipeline pipeline, List1 seenExceptions, TResponse response) at Elasticsearch.Net.Transport1.Request[TResponse](HttpMethod method, String path, PostData data, IRequestParameters requestParameters) at Elasticsearch.Net.ElasticLowLevelClient.DoRequest[TResponse](HttpMethod method, String path, PostData data, IRequestParameters requestParameters) at Elasticsearch.Net.NamespacedClientProxy.DoRequest[TResponse](HttpMethod post, String url, PostData body, IRequestParameters params) at Elasticsearch.Net.Specification.IndicesApi.LowLevelIndicesNamespace.PutTemplateForAll[TResponse](String name, PostData body, PutIndexTemplateRequestParameters requestParameters) at Serilog.Sinks.Elasticsearch.ElasticsearchSinkState.RegisterTemplateIfNeeded()

Any clue what I may be missing or any tip about how to find out where the error is?

serilog kibana elasticsearch asp.net-core
1 Answers

It seems the sink was not able to register the template with Elasticsearch. It's possible that it's because you're using a more recent version of Elasticsearch and not specifying which version you're using, so the sink assumes you're using an older version pre 5.0:

When using the AutoRegisterTemplate feature, this allows to set the Elasticsearch version. Depending on the version, a template will be selected. Defaults to pre 5.0.

You should AutoRegisterTemplateVersion.ESv7 or AutoRegisterTemplateVersion.ESv6 depending on which version you're using

e.g.

Log.Logger = new LoggerConfiguration()
    .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri("http://localhost:9200") )
    {
        AutoRegisterTemplate = true,
        AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7, // <<<<<#####
    })
    .CreateLogger();
user_2116720
Related