Logging templates

[Anders_Flemmen]

Is it possible to get Event Store to log to file with templates rendered? If not, does anyone have experience having Logstash do this?

Talking about these messages:
“@mt”: “Connection ‘{connectionName}{clientConnectionName}’ [{remoteEndPoint}, {connectionId:B}] Proactive heartbeat request sent to the remote party since no data was sent during the last heartbeat interval.”

Looks like Serilog also has an @m property, which is the rendered message, but I can not see that it is possible to enable this in Event Store? https://github.com/serilog/serilog-formatting-compact

[alexey.zimarev]

Should be possible with the default format using Json_line codec https://www.elastic.co/guide/en/logstash/current/plugins-codecs-json_lines.html

[Anders_Flemmen]

Do you have an example of this working? Can’t see anything mentioning this in the documentation? Tried it, but it does not seem to change anything, the message is still containing the templates.

[alexey.zimarev]

We will work on this, test it out and provide guidelines.

But IMO it’s easier to use Vector as we describe in the docs. Vector provider for ESDB supports logs, and adding Elastic sink should be trivial, so Vector would connect them together.

[oskar.dudycz]

@Anders_Flemmen, could you provide more details on why you need to have a rendered message? Do you want to shovel that to Elastic? In this case, by using the default Logstash config, e.g.

input {
  file{
    path => "YOUR_PATH/TO_LOGS/*.json"
    codec => json
  }
}

output {
  elasticsearch {
    hosts => [ "localhost:9200" ]
  }
}

It should load and enable you to filter by the fields, e.g.

Could you elaborate on your use case? I’m working currently to provide better guidance on how to configure EventStoreDB => ELK Stack logging, so feedback would be more than welcome so that I could understand your scenario.

[Anders_Flemmen]

Yes, in our case, the most useful field would be a fully rendered message in Elastic. Having parts of the message as separate fields is also nice, but when looking at logs, I usually want a quick overview of what is going on, which is not that easy when messages look like this: