custom configuration-time properties for serilog?

[Balfa]

Splunk's serilog sink allows setting a "source", which we set to "WeatherApi", "BlogPostApi", etc. so we can store logs from all our services in one splunk index, but still easily focus on just one at a time when we're tracking down a problem.

Am I missing something or is there no easy way to do the equivalent in the seq sink? We could even use something like the CustomFields property and set it at configuration time.

The only other solution I'm thinking of is just pushing some unique hardcoded log context at app startup, but that doesn't seem as nice, nor does it fit in well with our existing model.

[nblumhardt]

Hi Mo,

The best solution for this with Seq is to give each source a unique API key. Then, in the API key configuration on the Seq side, apply a property Source = ... to identify the events that are ingested using that API key. You can attach multiple properties to each key, so this is also where Environment etc. would normally be applied, if you need them.

This has a few advantages -

• The Data > Ingestion screen will then show you the log volume coming in from each source,
• You can suppress or filter ingestion from a single source, e.g. in the case of runaway logging, and
• Payloads are smaller (you don't need to redundantly send the same "source" properties with every event.

Docs on API keys are in https://docs.datalust.co/docs/api-keys.

If you decide to go the other way and configure it client-side, the Enrich.WithProperty("Source", value) option on Serilog's LoggerConfiguration does what you're looking for.

Hope this helps,
Nick

[Balfa]

Thanks @nblumhardt ! This looks like just what I need. And thanks for all your FOSS contributions 🤘

[nblumhardt]

Thanks @Balfa :-) 👍