[FEATURE] NLog - Ability to add custom fields to the log event.

[yorondevops]

Hi,

Would be great if there was a way to dynamically serialize key-value pairs from the MDLC as top-level fields in the event body, without placing them under the metadata field.

For example:
Using the latest version of Elastic.CommonSchema.NLog, an MDLC holding the key-value pairs "foo":"bar" and "abc":123 would be serialized into the event like this:

{
    "metadata" : {
        "foo": "bar",
        "abc": 123
    }
}

I think an option should exist to have them serialized directly at the top level of the event like this:

{
    "foo": "bar",
    "abc": 123
}

On issues similar to this (#104 and #141) others have already suggested using a logstash or ingest pipeline to rename the fields. I find that for larger scale multi-tenant setups, it works out much better to let each app owner get their desired fields right in their app "at the edge".

This can help by simplifying the process ("what you write is what you get"), giving developers more freedom to make changes independently, and removing the additional overhead of having to maintain one or more pipelines.

[snakefoot]

See also NLog/NLog#4982 for an example of customizing your own NLog JsonLayout that outs JSON in Ecs-Common-Schema-Format. Where you are free to customize it in whatever direction you like.

[Mpdreamz]

Thank you for raising this feature request.

With the new version known ECS properties will be picked up automatically. However unknown properties will always need to be mapped explicitly.

While with Serilog you can create generic sinks using your own EcsDocument subclasses utilizing its extension mechanisms: https://github.com/elastic/ecs-dotnet/tree/main/src/Elastic.CommonSchema?rgh-link-date=2023-02-07T13%3A10%3A15Z#extending-ecsdocument

I am not quite seeing a way to do the same our EcsLayout and continue to support the xml config as well: https://github.com/elastic/ecs-dotnet/tree/main/src/Elastic.CommonSchema.NLog#how-to-use-from-nlogconfig