CB.Serilog.Sinks.AzureLogAnalytics 1.2.0

Serilog Sink for Azure Log Analytics

A bare-bones custom Serilog sink for Azure Log Analytics. Supports batching of logs and utilizes the Azure.Monitor.Ingestion library for ingestion to Log Analytics via the new Log Ingestion API.

Prerequisites

1. Azure Subscription
2. Log Analytics workspace provisioned
3. A configured data collection endpoint and data collection rule in Azure with appropriate permissions.

Get Started

Install Package

dotnet add package CB.Serilog.Sinks.AzureLogAnalytics

Authenticate with Azure

By default, a DefaultAzureCredential is used to authenticate with Azure, meaning no additional code is needed if your environment is already configured. Optionally, a custom TokenCredential can be passed in during configuration.

Configure

The sink can be configured programmatically or through the Serilog.Settings.Configuration NuGet package via appsettings.json. An instance of AzureLogAnalyticsSinkConfiguration is required.

App Config Example

Program.cs

Host.CreateDefaultBuilder()
 .UseSerilog((hostingContext, services, loggerConfiguration) =>
 {
 var assemblies = new[] { typeof(AzureLogAnalyticsSink).Assembly };
 var options = new ConfigurationReaderOptions(assemblies);
 loggerConfiguration
 .Enrich.FromLogContext()
 .ReadFrom.Configuration(hostingContext.Configuration, options);
 });

appsettings.json

{
 "Serilog": {
 "Using": [ "CB.Serilog.Sinks.AzureLogAnalytics" ],
 "MinimumLevel": "Verbose",
 "WriteTo": [
 {
 "Name": "AzureLogAnalytics",
 "Args": {
 "DataCollectionEndpointUri": "https://<data-collection-endpoint>.logs1.azure.com",
 "RuleId": "dcr-<rule-id>",
 "StreamName": "Custom-MyLogs_CL",
 "OutputToConsole": true,
 "MaxLogEntries": 5
 }
 }
 ]
 }
}

IHostBuilder Example

Program.cs

Host.CreateDefaultBuilder()
 .UseSerilog((hostingContext, services, loggerConfiguration) =>
 {
 loggerConfiguration
 .Enrich.FromLogContext()
 .WriteTo.AzureLogAnalytics(new AzureLogAnalyticsSinkConfiguration
 {
 DataCollectionEndpointUri = new Uri("https://<data-collection-endpoint>.logs1.azure.com"),
 RuleId = "dcr-<rule-id>",
 StreamName = "Custom-MyLogs_CL",
 MaxLogEntries = 10,
 OutputToConsole = true
 // TokenCredential = new DefaultAzureCredential() // Optional
 });
 });

Configuration Options

The AzureLogAnalyticsSinkConfiguration type is used to configure the sink.

Default Log Schema

By default, if you don't provide a custom Transform function, the sink maps Serilog properties to the following JSON structure which you will need to map your Data Collection Rule schema to:

{
 "Timestamp": "2023-10-01T12:00:00.0000000Z",
 "Level": "Information",
 "Message": "This is a log message",
 "Exception": "Exception details if any",
 "Properties": {
 "CustomProperty": "CustomValue"
 }
}

You should define your custom Log Analytics table columns appropriately to match the default transformation output, or provide your own Transform function if your schema dictates a different structure.