{"id":21880740,"url":"https://github.com/elders/log4net.appender.elasticsearch","last_synced_at":"2025-10-24T16:48:26.107Z","repository":{"id":122286008,"uuid":"156364442","full_name":"Elders/log4net.Appender.ElasticSearch","owner":"Elders","description":"ElasticSearch appender for log4net","archived":false,"fork":false,"pushed_at":"2019-05-21T08:56:00.000Z","size":82,"stargazers_count":4,"open_issues_count":1,"forks_count":4,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-15T05:31:33.934Z","etag":null,"topics":["appender","elasticsearch","log","log4net"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Elders.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-11-06T10:11:43.000Z","updated_at":"2024-01-05T03:22:25.000Z","dependencies_parsed_at":"2023-03-18T05:15:38.767Z","dependency_job_id":null,"html_url":"https://github.com/Elders/log4net.Appender.ElasticSearch","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/Elders/log4net.Appender.ElasticSearch","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Elders%2Flog4net.Appender.ElasticSearch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Elders%2Flog4net.Appender.ElasticSearch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Elders%2Flog4net.Appender.ElasticSearch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Elders%2Flog4net.Appender.ElasticSearch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Elders","download_url":"https://codeload.github.com/Elders/log4net.Appender.ElasticSearch/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Elders%2Flog4net.Appender.ElasticSearch/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280833009,"owners_count":26398970,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-24T02:00:06.418Z","response_time":73,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appender","elasticsearch","log","log4net"],"created_at":"2024-11-28T09:15:50.138Z","updated_at":"2025-10-24T16:48:26.099Z","avatar_url":"https://github.com/Elders.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"log4net.Appender.ElasticSearch\n=====================\n\n**The project is hard forked from **[urielha/log4stash](https://github.com/urielha/log4stash)**. We needed to target netstandard2.0 explicitly. Furthermore, we removed a lot of features which were not needed and added build scripts using [Nyx](https://github.com/Elders/Nyx).**\n\nlog4net.Appender.ElasticSearch is a [log4net](http://logging.apache.org/log4net/) appender to log messages to the [ElasticSearch](http://www.elasticsearch.org) document database. ElasticSearch offers robust full-text search engine and analyzation so that errors and messages can be indexed quickly and searched easily.\n\nThe origin of log4net.Appender.ElasticSearch is [@jptoto](https://github.com/jptoto)'s [log4net.ElasticSearch](https://github.com/jptoto/log4net.ElasticSearch) repository and [@urielha](https://github.com/uriehla)'s [log4stash](https://github.com/urielha/log4stash).\n\n### Features:\n* **Targets NetStandard 2.0**\n* Easy installation and setup via [Nuget](https://www.nuget.org/packages/log4net.Appender.ElasticSearch/)\n* Ability to analyze the log event before sending it to elasticsearch using built-in filters and custom filters similar to [logstash](http://logstash.net/docs/1.4.2/).\n\n\n### Filters:\n* [**Add**][docs-filters-add] - add new key and value to the event.\n* [**Remove**][docs-filters-remove] - remove key from the event.\n* [**Rename**][docs-filters-rename] - rename key to another name.\n* **Kv** - analyze value (default is to analyze the 'Message' value) and export key-value pairs using regex (similar to logstash's kv filter).\n* **Grok** - analyze value (default is 'Message') using custom regex and saved patterns (similar to logstash's grok filter).\n* **ConvertToArray** - split raw string to an array by given seperators. \n* **Json** - convert json string to an object (so it will be parsed as object in elasticsearch).\n* **Convert** - Available convertors: `ToString`, `ToLower`, `ToUpper`, `ToInt` and `ToArray`. See [config example][config-example] for more information. \n* **Xml** - Parse xml into an object.\n\n#### Custom filter:\nTo add your own filters you just need to implement the interface IElasticAppenderFilter on your assembly and configure it on the log4net configuration file.\n\n### Issues:\nI do my best to reply to issues or questions ASAP. Please use the issues page to submit questions or errors.\n\n### Configuration Examples:\n\nAlmost all the parameters are optional, to see the default values check the [constructor](https://github.com/Elders/log4net.Appender.ElasticSearch/blob/master/src/Elders.log4net.Appender.ElasticSearch/ElasticSearchAppender.cs#L81) of the appender and the constructor of every filter. \nYou can also set any public property in the appender/filter which didn't appear in the example.\n\n##### Simple configuration:\n```xml\n\u003cappender name=\"ElasticSearchAppender\" type=\"log4net.Appender.ElasticSearch.ElasticSearchAppender, log4net.Appender.ElasticSearch\"\u003e\n    \u003cServer\u003elocalhost\u003c/Server\u003e\n    \u003cPort\u003e9200\u003c/Port\u003e\n    \u003cElasticFilters\u003e\n      \u003c!-- example of using filter with default parameters --\u003e\n      \u003ckv /\u003e \n    \u003c/ElasticFilters\u003e\n\u003c/appender\u003e\n```\n\n##### (Almost) Full configuration:\n```xml\n\u003cappender name=\"ElasticSearchAppender\" type=\"log4net.Appender.ElasticSearch.ElasticSearchAppender, log4net.Appender.ElasticSearch\"\u003e\n    \u003cServer\u003elocalhost\u003c/Server\u003e\n    \u003cPort\u003e9200\u003c/Port\u003e\n    \u003c!-- optional: in case elasticsearch is located behind a reverse proxy the URL is like http://Server:Port/Path, default = empty string --\u003e\n    \u003cPath\u003e/es5\u003c/Path\u003e\n    \u003cIndexName\u003elog_test_%{+yyyy-MM-dd}\u003c/IndexName\u003e\n    \u003cIndexType\u003eLogEvent\u003c/IndexType\u003e\n    \u003cBulksize\u003e2000\u003c/Bulksize\u003e\n    \u003cBulkIdleTimeout\u003e10000\u003c/BulkIdleTimeout\u003e\n    \u003cIndexAsync\u003eFalse\u003c/IndexAsync\u003e\n    \u003cDocumentIdSource\u003eIdSource\u003c/DocumentIdSource\u003e \u003c!-- obsolete! use IndexOperationParams --\u003e\n    \n    \u003c!-- Serialize log object as json (default is true).\n      -- This in case you log the object this way: `logger.Debug(obj);` and not: `logger.Debug(\"string\");` --\u003e\n    \u003cSerializeObjects\u003eTrue\u003c/SerializeObjects\u003e \n\n    \u003c!-- optional: elasticsearch timeout for the request, default = 10000 --\u003e\n    \u003cElasticSearchTimeout\u003e10000\u003c/ElasticSearchTimeout\u003e\n\n    \u003c!--You can add parameters to the request to control the parameters sent to ElasticSearch.\n    for example, as you can see here, you can add a routing specification to the appender.\n    The Key is the key to be added to the request, and the value is the parameter's name in the log event properties.--\u003e\n    \u003cIndexOperationParams\u003e\n      \u003cParameter\u003e\n        \u003cKey\u003e_routing\u003c/Key\u003e\n        \u003cValue\u003e%{RoutingSource}\u003c/Value\u003e\n      \u003c/Parameter\u003e\n      \u003cParameter\u003e\n        \u003cKey\u003e_id\u003c/Key\u003e\n        \u003cValue\u003e%{IdSource}\u003c/Value\u003e\n      \u003c/Parameter\u003e\n      \u003cParameter\u003e\n        \u003cKey\u003ekey\u003c/Key\u003e\n        \u003cValue\u003evalue\u003c/Value\u003e\n      \u003c/Parameter\u003e\n    \u003c/IndexOperationParams\u003e\n\n    \u003c!-- for more information read about log4net.Core.FixFlags --\u003e\n    \u003cFixedFields\u003ePartial\u003c/FixedFields\u003e\n    \n    \u003cTemplate\u003e\n      \u003cName\u003etemplateName\u003c/Name\u003e\n      \u003cFileName\u003epath2template.json\u003c/FileName\u003e\n    \u003c/Template\u003e\n\n    \u003c!--Only one credential type can used at once--\u003e\n    \u003c!--Here we list all possible types--\u003e\n    \u003cAuthenticationMethod\u003e\n      \u003c!--For basic authentication purposes--\u003e\n      \u003cBasic\u003e\n          \u003cUsername\u003eUsername\u003c/Username\u003e\n          \u003cPassword\u003ePassword\u003c/Password\u003e\n      \u003c/Basic\u003e\n      \u003c!--For AWS ElasticSearch service--\u003e\n      \u003cAws\u003e\n          \u003cAws4SignerSecretKey\u003eSecret\u003c/Aws4SignerSecretKey\u003e\n          \u003cAws4SignerAccessKey\u003eAccessKey\u003c/Aws4SignerAccessKey\u003e\n          \u003cAws4SignerRegion\u003eRegion\u003c/Aws4SignerRegion\u003e\n      \u003c/Aws\u003e\n    \u003c/AuthenticationMethod\u003e\n    \n    \u003c!-- all filters goes in ElasticFilters tag --\u003e\n    \u003cElasticFilters\u003e\n      \u003cAdd\u003e\n        \u003cKey\u003e@type\u003c/Key\u003e\n        \u003cValue\u003eSpecial\u003c/Value\u003e\n      \u003c/Add\u003e\n\n      \u003c!-- using the @type value from the previous filter --\u003e\n      \u003cAdd\u003e\n        \u003cKey\u003eSmartValue\u003c/Key\u003e\n        \u003cValue\u003ethe type is %{@type}\u003c/Value\u003e\n      \u003c/Add\u003e\n\n      \u003cRemove\u003e\n        \u003cKey\u003e@type\u003c/Key\u003e\n      \u003c/Remove\u003e\n\n      \u003c!-- you can load custom filters like I do here --\u003e\n      \u003cFilter type=\"log4stash.Filters.RenameKeyFilter, log4stash\"\u003e\n        \u003cKey\u003eSmartValue\u003c/Key\u003e\n        \u003cRenameTo\u003eSmartValue2\u003c/RenameTo\u003e\n      \u003c/Filter\u003e\n    \n      \u003c!-- converts a json object to fields in the document --\u003e\n      \u003cJson\u003e\n        \u003cSourceKey\u003eJsonRaw\u003c/SourceKey\u003e\n        \u003cFlattenJson\u003efalse\u003c/FlattenJson\u003e\n        \u003c!-- the separator property is only relevant when setting the FlattenJson property to 'true' --\u003e\n        \u003cSeparator\u003e_\u003c/Separator\u003e \n      \u003c/Json\u003e\n\n      \u003c!-- converts an xml object to fields in the document --\u003e\n      \u003cXml\u003e\n        \u003cSourceKey\u003eXmlRaw\u003c/SourceKey\u003e\n        \u003cFlattenXml\u003efalse\u003c/FlattenXml\u003e\n      \u003c/Xml\u003e\n      \n      \u003c!-- kv and grok filters similar to logstash's filters --\u003e\n      \u003cKv\u003e\n        \u003cSourceKey\u003eMessage\u003c/SourceKey\u003e\n        \u003cValueSplit\u003e:=\u003c/ValueSplit\u003e\n        \u003cFieldSplit\u003e ,\u003c/FieldSplit\u003e\n      \u003c/kv\u003e\n\n      \u003cGrok\u003e\n        \u003cSourceKey\u003eMessage\u003c/SourceKey\u003e\n        \u003cPattern\u003ethe message is %{WORD:Message} and guid %{UUID:the_guid}\u003c/Pattern\u003e\n        \u003cOverwrite\u003etrue\u003c/Overwrite\u003e\n      \u003c/Grok\u003e\n\n      \u003c!-- Convert string like: \"1,2, 45 9\" into array of numbers [1,2,45,9] --\u003e\n      \u003cConvertToArray\u003e\n        \u003cSourceKey\u003esomeIds\u003c/SourceKey\u003e\n        \u003c!-- The separators (space and comma) --\u003e\n        \u003cSeperators\u003e, \u003c/Seperators\u003e \n      \u003c/ConvertToArray\u003e\n\n      \u003cConvert\u003e\n        \u003c!-- convert given key to string --\u003e\n        \u003cToString\u003eshouldBeString\u003c/ToString\u003e\n\n        \u003c!-- same as ConvertToArray. Just for convenience --\u003e\n        \u003cToArray\u003e\n           \u003cSourceKey\u003eanotherIds\u003c/SourceKey\u003e\n        \u003c/ToArray\u003e\n      \u003c/Convert\u003e\n    \u003c/ElasticFilters\u003e\n\u003c/appender\u003e\n```\n\nNote that the filters got called by the order they appeared in the config (as shown in the example).\n\n### Templates:\nTo get to know the [ElasticSearch templates](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html) follow the link.\n\nYou can follow the link to read more about [dynamic mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/default-mapping.html).\n\n### License:\n[MIT License](https://github.com/urielha/log4stash/blob/master/LICENSE)\n\n### Thanks:\nThanks to [@jptoto](https://github.com/jptoto) for the idea and the first working ElasticAppender.\nMany thanks to [@mpdreamz](https://github.com/Mpdreamz) and the team for their great work on the NEST library!\nThe inspiration to the filters and style had taken from [elasticsearch/logstash](https://github.com/elasticsearch/logstash) project.\nThanks to [Uriehla](https://github.com/urielha/log4stash/) for the integration of Logstash and Log4net appender. ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felders%2Flog4net.appender.elasticsearch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Felders%2Flog4net.appender.elasticsearch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felders%2Flog4net.appender.elasticsearch/lists"}