Missing {"@ in body

[JakobVork]

Hi,

I have been using serilog for some time now, and have noticed that we once in a while are missing some logs. When I looked into what might caused this I found the following:

First I created a test API that recieved a call and when logged it into a bufferFile (That never miss a log btw).
I when created a program, that sent 5000 requests to the API. I could see 5000 logs in the bufferFile, but only 4999 logs when I looked at kibana.

I when looked at the network traffic, and found the following:

If we take a look on the server running elasticsearch it gives this error:

So, from what I can see is that serilog sometimes cuts {"@ away from timestamp. I've tried to run it multiple times, but it does not always happen. (Often need to run it 4-10 times before I see the error again). It is however always the second log that fails.
The bufferFile does not cut away {"@ as shown below:

Not sure why this happens, and especially why this only happens sometimes?

Currently running with ElasticSearch 5.2.1 and Kibana 5.2.1.
The nuget package I use is Serilog.Sinks.Elasticsearch version 5.0.0 (depend on serilog version 2.2.1)

[nblumhardt]

This sounds like datalust/serilog-sinks-seq#28 - caused by HttpLogShipper expecting the (three-byte) Unicode BOM, but more recent versions of Serilog.Sinks.File (and RollingFile) defaulting to no-BOM.

[JakobVork]

I have now tried to upgrade Serilog.Sinks.File to version 3.2.0, but the behavior is still the same. (Even though, the original dep. was => 3.0.1, and therefore still newer than the mentioned in the link you provided).

[nblumhardt]

If the issue is the linked one, a fix will be required in this repository.

The fix is: datalust/serilog-sinks-seq@6c0b308

If anyone can PR this I can help with review etc.

Cheers,
Nick

[mivano]

This one is merged in v 5.5