ConversionPattern not enforced about log4net.elasticsearch

[jptoto]

@Pragmateek Thanks for the report! I'll check into this ASAP and see if I've got it implemented correctly.

[Pragmateek]

@jptoto Thanks for the quick feedback!
I'm probably missing something and doing stupid things. :)

[jptoto]

@Pragmateek What field in the Elasticsearch document are you looking for the event information? Now that you've added this note, it's made me realize that the ConversionPattern may be completely irrelevant to logging in Elasticsearch since all the fields are logged in the ES document anyway. Since all the fields are there, there isn't really any work to be done by choosing a pattern as if it were in a text log file.

Which field in the Elasticsearch document are you looking for the converted text?

[Pragmateek]

@jptoto This is the message field.
I had the same reflexion before posting but I though it could be applied anyway as it may ease future searches: you only have to look to the message field without crafting queries that span multiple fields, and you could more easily compare with information extracted from files and console output.
But if this is by-design I'm completely OK with it and I can confirm this to my colleagues to adapt the way we use these logs. :)

[Pragmateek]

@jptoto Moreover one of my colleagues reminds me of another use-case where we can't do without the ConversionPattern: in order to identify which application is logging it is possible to add a tag like [MyApplication] to the ConversionPattern so that every message will be decorated accordingly.
Or if your appender supports addition of a dedicated field, say "appName", to the ElasticSearch index, this would be a cleaner alternative to messages decoration.
Thanks.

[jptoto]

@Pragmateek The application is available in the "domain" field of the ES document. That is the appdomain. I'm pretty sure I've covered all the possible fields that are available from log4net so they are easily readable from the index. Really, that would remove the need to using a ConversionPattern because, unlike in text or DB log file where fields may be limited, in log4net.ElasticSearch, I simply log all the fields.

It's possible to use the ConversionPattern to format the message field but I haven't had any requests for that as yet. This is an image showing a basic layout of how the doc would look in ES http://take.ms/fGQt2 and you can see in the domain field is the appdomain so you can tell which application is logging the message.

[Pragmateek]

@jptoto Thanks for these information.
So finally we've decided to let the message unformatted and play with the domain field if necessary.
Thanks again for your help and keep up the good job! :-)

[jptoto]

No problem! @Pragmateek I take the feedback seriously so please let me know if you have any other concerns or issues.

I'm going to update the documentation accordingly to mention that ConversionPattern isn't needed.