语义日志记录进程外 ElasticSearch 配置

Question

我正在尝试使用 ETW/Out-Of-Process 日志记录正确配置 ElasticSearch。我已成功安装最新版本的进程外记录器，并按照 SLAB site.

上概述的步骤进行操作

我的 SemanticLogging-svc.xml 看起来像这样：

<?xml version="1.0" encoding="utf-8" ?>
<configuration xmlns="http://schemas.microsoft.com/practices/2013/entlib/semanticlogging/etw"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://schemas.microsoft.com/practices/2013/entlib/semanticlogging/etw SemanticLogging-svc.xsd">
  
  <!-- Optional settings for fine tuning performance and Trace Event Session identification-->
  <traceEventService/>

  <!-- Sinks reference definitons used by this host to listen ETW events -->
  <sinks>
        <elasticsearchSink instanceName="slabtest" connectionString="http://localhost:9200" name="out" index="outofprocessslab" type="test">
      <sources>
        <eventSource name="ServiceBaseEventSource" level="LogAlways"/>
      </sources>
    </elasticsearchSink>
  
  
    <!-- The service identity should have security permissions to access the resource according to each event sink -->
    <flatFileSink name="svcRuntime" fileName="SemanticLogging-svc.runtime.log" >
      <sources>
        <!-- The below settings shows a simple configuration sample for the buit-in non-transient fault tracing -->
        <!-- Remove this eventSource if you'd like, and add your own configuration according to the documentation -->
        <!-- The name attribute is from the EventSource.Name Property -->
        <eventSource name="ServiceBaseEventSource" level="LogAlways"/>
      </sources>
      <!--[Add any built-in or custom formatter here if the sink supports text formatters]-->
      <eventTextFormatter header="----------"/>
    </flatFileSink>
    
    <!--[Add any built-in or custom sink definition here]-->
  
  </sinks>

</configuration>

但是，当我尝试启动该服务时，出现以下错误消息：

c:\slab-svc2\tools>SemanticLogging-svc.exe -c
Enterprise Library Semantic Logging Service v2.0.1406.1
Microsoft Enterprise Library
Microsoft Corporation


One or more errors occurred when loading the TraceEventService configuration file.
Configuration file: C:\Tools\slab-svc2\tools\SemanticLogging-svc.xml
The element 'sinks' has invalid child element 'elasticsearchSink'. List of possible elements expecte
d: 'flatFileSink, rollingFlatFileSink, windowsAzureTableSink, sqlDatabaseSink, consoleSink, customSi
nk' as well as any element in namespace '##other'.
Line number: 11, Line position: 7

我还应该注意，我已经下载了 FullScale180.SemanticLogging.Elasticsearch nuget 包并将其放在与可执行文件相同的目录中。我看到一个模糊的博客 post 说 SLAB 的 ElasticSearch 组件现在是一个社区项目，它为我指明了那个方向。但是我如何配置它以使用进程外服务？

谢谢。

Answer 1

万一有人感兴趣....似乎 SLAB Out-Of-Process Service 2.0 不再支持 ElasticSearch。我通过回滚到 1.1 版解决了这个问题。

Answer 2

Ohlando，似乎不再直接支持 elasticsearchSink 配置元素（在 2.0 中）。但是，您可以从 git 下载代码，elasticsearch dll (Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Elasticsearch.dll) 仍在项目中。如果你添加一个 customSink 属性，你可以让它工作。这是我如何让它工作的：

<customSink type=" Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Sinks.ElasticsearchSink,Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Elasticsearch" 
 name="ElasticSearchOutput">
  <sources>
    <eventSource name="EventName" level="LogAlways"/>
  </sources>
<parameters>
    <parameter name="instanceName" type="System.String" value="instance" />
    <parameter name="connectionString" type="System.String" value="http://localhost:9200" />
    <parameter name="index" type="System.String" value="indexWithoutTheMinus" />
    <parameter name="type" type="System.String" value="TypeHere" />
    <parameter name="flattenPayload" type="System.Nullable`1[[System.Boolean, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]" value="false" />
    <parameter name="bufferInterval" type="System.TimeSpan" value="00:00:01" />
    <parameter name="bufferingCount" type="System.Int32" value="1" />
    <parameter name="maxBufferSize" type="System.Int32" value="500" />
    <parameter name="onCompletedTimeout" type="System.TimeSpan" value="00:00:10" />

这在 v2 中对我有用！不过，我在任何文档中都找不到这个。我还想知道 SLAB 团队是否有人读过这篇文章并评论是否有办法将 shorthand 配置添加回二进制文件？我已经下载并浏览了代码，但我还没有找到发生这种情况的地方。

谢谢斯科特

语义日志记录进程外 ElasticSearch 配置

Semantic Logging Out-Of-Process ElasticSearch Configuration

.net

etw

enterprise-library-5

elasticsearch

slab