serilog log different format between .net core 6 and .net core 8 for http sink (problem in http sink after 7.2.0 version)

Question

I am using http sink of serilog. previously my logs was sent to my http log end point like following

{
  "events": [
    {
      "Timestamp": "2024-09-11T13:22:00.8350743+01:00",
      "Level": "Information",
      "MessageTemplate": "User profile is available. Using '{FullName}' as key repository and Windows DPAPI to encrypt keys at rest.",
      "RenderedMessage": "User profile is available. Using '\"C:\\Users\\kamran.shahid\\AppData\\Local\\ASP.NET\\DataProtection-Keys\"' as key repository and Windows DPAPI to encrypt keys at rest.",
      "Properties": {
        "FullName": "C:\\Users\\kamran.shahid\\AppData\\Local\\ASP.NET\\DataProtection-Keys",
        "EventId": {
          "Id": 63,
          "Name": "UsingProfileAsKeyRepositoryWithDPAPI"
        },
        "SourceContext": "Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager"
      }
      ]
 }

now after updating my project to .net 8 my logs are sending in this format

[
  {
    "Timestamp": "2024-09-11T12:10:51.2656227Z",
    "Level": "Information",
    "MessageTemplate": "User profile is available. Using '{FullName}' as key repository and Windows DPAPI to encrypt keys at rest.",
    "RenderedMessage": "User profile is available. Using '\"C:\\Users\\kamran.shahid\\AppData\\Local\\ASP.NET\\DataProtection-Keys\"' as key repository and Windows DPAPI to encrypt keys at rest.",
    "Properties": {
      "FullName": "C:\\Users\\kamran.shahid\\AppData\\Local\\ASP.NET\\DataProtection-Keys",
      "EventId": {
        "Id": 63,
        "Name": "UsingProfileAsKeyRepositoryWithDPAPI"
      },
      "SourceContext": "Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager"
    }
  }
]

any idea what could be wrong Problem seems to be in http sink version after 7.2.0 version. 9.0.0, 8.0.0 all having this problem

Answer 1

This change occurred in Release v8.0.0-beta.11. You can see the Release Notes, and the code for old versions, here.

The code that produced your old payload was in DefaultBatchFormatter.cs (which implemented IBatchFormatter) and looked like this:

public override void Format(IEnumerable<string> logEvents, TextWriter output)
{
    // snip
    output.Write("{\"events\":[");

    // snip
    foreach (var logEvent in logEvents)
    {
        // snip
    }

    output.Write("]}");
}

This file was removed in this changeset in favour of ArrayBatchFormatter.cs (also implementing IBatchFormatter), for which the equivalent code looks like this:

public void Format(IEnumerable<string> logEvents, TextWriter output)
{
    //snip
    output.Write("[");

    //snip
    foreach (var logEvent in logEvents)
    {
        //snip
    }

    output.Write("]");
}

The primary README.md file was changed at the same time. You can see the diff below:

So the short answer to "How can I send my log entries in the previous format" is that you can't, at least not without overriding some classes or forking the code. This was a breaking change (albeit one covered only obliquely by the Release Notes, at least as far as I can see) and unfortunately you will need to adapt your code and payload consumers accordingly.