0

I'm logging user actions in ElasticSearch and I'm using C# Log4Net

I'm using the C# NEST library to access the ElasticSearch database.

My log line looks like this:

{
      "_index" : "log-2016.07.27",
      "_type" : "logEvent",
      "_id" : "AVYrwmW5Hc5CAgECpn_X",
      "_score" : 1.0,
      "_source" : {
        "timeStamp" : "2016-07-27T09:49:35.3774113Z",
        "message" : "Upload file operation took 11683 ms",
        "loggerName" : "Reviewer.Web.WebApi.GroupsController",
        "identity" : "",
        "level" : "INFO",
        "properties" : {
          "log4net:UserName" : "CORP\\g",
          "log4net:ElapsedTime" : "11683",
          "log4net:Identity" : "",
          "IP" : "::1",
          "log4net:HostName" : "GBWOTIOM68052D",
          "@timestamp" : "2016-07-27T09:49:35.3774113Z"
        }
      }

I'd like to have the log4net:ElapsedTime value stored as an integer instead of a string.

currently I'm doing this when storing an elapsed time:

long ms = 1000;
LogicalThreadContext.Properties["log4net:ElapsedTime"] = ms;

I know I should specify a template in order to tell ElasticSearch to store the elapsed value as an integer but how to do it?

Gianluca Ghettini
  • 11,129
  • 19
  • 93
  • 159

1 Answers1

1

If you want elasticsearch to recognize your field you should send your data value without double-quotes. 

curl -XPUT 'localhost:9200/tmp/tmp/1' -d '{
   "field1":"3",
   "field2":3
}'

-

curl -XGET 'localhost:9200/tmp'
{"tmp":{"aliases":{},"mappings":{"tmp":{"properties":{"field1":{"type":"string"},"field2":{"type":"long"}}}},"settings":{"index":{"creation_date":"1469621916488","uuid":"Qj64-CU5RUW6ShOyRqLZXQ","number_of_replicas":"0","number_of_shards":"1","version":{"created":"1070599"}}},"warmers":{}}}

You can see field1 is string but field2 is numeric.

alpert
  • 4,500
  • 1
  • 17
  • 27