How to Log to Elastic Search by NLog or SeriLog with authentications

For NLog there is a target "NLog.Targets.ElasticSearch" (nuget)which uses the Elasticsearch.Net package.

Usage:

<nlog>  <extensions>    <add assembly="NLog.Targets.ElasticSearch"/>  </extensions>  <targets>    <target name="elastic" xsi:type="BufferingWrapper" flushTimeout="5000">      <target xsi:type="ElasticSearch"           requireAuth="true"         username="myUserName"         password="coolpassword"/>    </target>  </targets>  <rules>    <logger name="*" minlevel="Info" writeTo="elastic" />  </rules></nlog>

Docs for the parameters: https://github.com/ReactiveMarkets/NLog.Targets.ElasticSearch/wiki

Please note:

• If you need to use Elasticsearch.Net 6 (equivalent to Elastic Search version 6 or later), you need NLog.Targets.ElasticSearch version 5.
• For Elasticsearch.Net 5 you need to use NLog.Targets.ElasticSearch 4

Since you want to log into ElasticSearch, it's best if you use a Logging framework that supports Structured Logging which for [NLog] this feature is in beta RTM.

You can Serilog as your Logging Framework which supports Structured Logging.

And there's also Serilog sink for ElasticSearch https://github.com/serilog/serilog-sinks-elasticsearch

You should add these nuget packages to your project :

SerilogSerilog.Sinks.ElasticSearch  

This is a sample code for config of Serilog to sink to ElasticSearch

var logger = new LoggerConfiguration()    .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri("http://localhost:9200"))    {        ModifyConnectionSettings = x => x.SetBasicAuthentication(username, password);    })    .CreateLogger();

Many recommends that the application should not write directly to ElasticSearch, but should just write to local files.

Then have a service (Ex. FileBeat) to upload the contents of the log-files into ElasticSearch.

This will optimize network traffic to the ElasticSearch instance (bulk), and will ensure logging is not lost if problems with the network or ElasticSearch instance is restarted because of maintenance.