Serilog Elasticsearch logs not making it to the server (but buffering correctly)

Question

I have an ELK stack locally hosted (v7.0) on a Windows IIS web server and the logs are not making it to the server. Server is running, I can reach the reserved URL and get back the generic json package saying Elasticsearch is running and I can log into Kibana just fine, there's just no logs to see.

I have a bufferBaseFilename set in the apps that are logging, and when I go to that location the logs are actually there, properly indexed and all. I'm wondering why it never gets synced back to the server? It seems like a connection issue, but all the network stuff checks out. I'm probably missing something simple. Any thoughts? Let me know if you need more information!

Answer 1

A frequent source for this error is a malformed (template) request that does not match your ES version (e.g. contains deprecated fields). You could try to

• use a preview version of the nuget package
• set DetectElasticsearchVersion to true
• set RegisterTemplateFailure to IndexAnyway

You can configure the sink like so:

var loggerConfig = new LoggerConfiguration()
    .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri(...) ){
        // ...
        DetectElasticsearchVersion = true,
        RegisterTemplateFailure = RegisterTemplateFailure.IndexAnyway
     });

Answer 2

I had this issue and for me, it was the w3wp.exe process that blocked a couple earlier buffer logs from pushing to elastic search, and everything that came after was also on queue.

I resolved it by killing the process.