.NET Logger Parsing

Overview

.NET apps that write log messages using Microsoft.Extensions.Logging generate a multi-line log message in a structured format, including the component, event ID, scope values, a message, and optionally an exception. This is often used by .NET apps that write data to the Windows event log. (For example, ImmyBot.) AutoExtract recognizes this layout, extracts all the structured information, and organizes the message so the most important information is on the first line of the message.

Extracted Fields

• category: the component that logged the message, for example Contoso.Agent.Services.RealtimeConnectionManager.
• x.dotnet.event_id: the app's event ID, when it is not 0.
• x.exception.type: the full exception type, when the message carries an exception.
• One x. field per scope value written as Name: value, for example x.Caller or x.LineNumber.

The message is rewritten so that the message text is first, followed by the short exception type and its message on the same line, then the scope lines, then the full exception and stack trace.

Example

Try AutoExtract on this message to see the result:

Category: Contoso.Agent.Services.RealtimeConnectionManager EventId: 4 Caller: ConnectToHub LineNumber: 78 Failed to connect Exception: System.Net.Http.HttpRequestException: No such host is known. (relay.contoso.example:443) ---> System.Net.Sockets.SocketException (11001): No such host is known. at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)

The stored message's first line becomes:

Failed to connect; HttpRequestException; No such host is known. (relay.contoso.example:443)