从 Elastic Common Schema 日志中删除不必要的对象

Question

我正在使用 Serilog 和 Elastic.CommonSchema.Serilog 来获取包含 JSON 格式的 ECS 字段的控制台日志。

我不需要在输出中包含诸如 host、process 之类的对象。我怎样才能删除它们？

环境：

ASP.NET Core 6 / Alpine Linux 容器

代码：

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Is(LogEventLevel.Debug)
    .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
    .MinimumLevel.Override("Microsoft.Hosting.Lifetime", LogEventLevel.Information)
    .Enrich.FromLogContext()
    .WriteTo.Async(a => a.Console(new EcsTextFormatter()))
    .CreateLogger();

appsettings.json

中没有任何与Serilog相关的修改

我的输出低于预期。

{
    "@timestamp": "2023-08-16T10:06:24.0917831+00:00",
    "log.level": "Information",
    "message": "xxxx ccccc vvvv",
    "ecs.version": "8.6.0",
    "log": {
        "logger": "xx.yy.ccc.BBBB"
    },
    "labels": {
        "MessageTemplate": "xxxx ccccc vvvv""
    },
    "agent": {
        "type": "Elastic.CommonSchema.Serilog",
        "version": "8.6.1"
    },
    "event": {
        "created": "2023-08-16T10:06:24.0917831+00:00",
        "severity": 2,
        "timezone": "Coordinated Universal Time"
    },
    "host": {
        "os": {
            "full": "aaaa xxx yyy",
            "platform": "vvvv",
            "version": "x.x.x.xx"
        },
        "architecture": "X64",
        "hostname": "xxxx"
    },
    "process": {
        "name": "xxx",
        "pid": 11,
        "thread.id": 4,
        "thread.name": "xxxx",
        "title": ""
    },
    "service": {
        "name": "xxx",
        "type": "xxx",
        "version": "1.0.0"
    },
    "user": {
        "domain": "xxx",
        "name": ""
    }
}

Answer 1

您可以通过 EcsTextFormatter 上的一些配置删除日志的几部分：

builder.Host.UseSerilog(
        (ctx, config) =>
        {
            var httpAccessor = ctx.Configuration.Get<HttpContextAccessor>();

            config
                .ReadFrom.Configuration(ctx.Configuration)
                .Enrich.WithEcsHttpContext(httpAccessor!)
                .WriteTo.Console(new EcsTextFormatter(new EcsTextFormatterConfiguration
                {
                    IncludeHost = false,
                    IncludeProcess = false,
                    IncludeUser = false
                }));
        });