ElasicSearch 7.0 support

[kanadaj]

ElasticSearch 7 isn't currently supported due to a change in how templates operate - the default keyword is not accepted anymore.

The new template has to completely ditch the default flag:

        private static object GetTemplateESv7(
            Dictionary<string, string> settings,
            string templateMatchString)
        {
            return new
            {
                index_patterns = new[] { templateMatchString },
                settings = settings,
                mappings = new
                {
                    dynamic_templates = new List<Object>
                    {
                        //when you use serilog as an adaptor for third party frameworks
                        //where you have no control over the log message they typically
                        //contain {0} ad infinitum, we force numeric property names to
                        //contain strings by default.
                        {
                            new
                            {
                                numerics_in_fields = new
                                {
                                    path_match = @"fields\.[\d+]$",
                                    match_pattern = "regex",
                                    mapping = new
                                    {
                                        type = "text",
                                        index = true,
                                        norms = false
                                    }
                                }
                            }
                        },
                        {
                            new
                            {
                                string_fields = new
                                {
                                    match = "*",
                                    match_mapping_type = "string",
                                    mapping = new
                                    {
                                        type = "text",
                                        index = true,
                                        norms = false,
                                        fields = new
                                        {
                                            raw = new
                                            {
                                                type = "keyword",
                                                index = true,
                                                ignore_above = 256
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    },
                    properties = new Dictionary<string, object>
                    {
                        {"message", new {type = "text", index = "true"}},
                        {
                            "exceptions", new
                            {
                                type = "nested",
                                properties = new Dictionary<string, object>
                                {
                                    {"Depth", new {type = "integer"}},
                                    {"RemoteStackIndex", new {type = "integer"}},
                                    {"HResult", new {type = "integer"}},
                                    {"StackTraceString", new {type = "text", index = "true"}},
                                    {"RemoteStackTraceString", new {type = "text", index = "true"}},
                                    {
                                        "ExceptionMessage", new
                                        {
                                            type = "object",
                                            properties = new Dictionary<string, object>
                                            {
                                                {"MemberType", new {type = "integer"}},
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            };
        }```

Also, upgrading from ES6 requires the deletion of the previous template:

DELETE /_template/serilog-events-template```

Maybe do a consistency check on the template via GET and automatically re-create the template for ES7 if there was an upgrade?

[ffMathy]

I would like to know this too. NEST has already released in Alpha. Perhaps we should make an Alpha of this library also, so that people at least have the choice.

[kanadaj]

I have a fork here that uses the v7 alpha NEST SDK and also has the V7 template:
https://github.com/kanadaj/serilog-sinks-elasticsearch

Would love to pull it to a separate branch but cannot since that needs upstream perms.

A word of warning though - the v7 ElasticSearch SDK only targets .NET Standard 2.0, so no .NET Standard 1.1 or .NET Framework 4.5.1 target for it. I've added conditionals to target the new SDK only on .NET Standard 2.0 in my fork, but this is really something the maintainers need to consider on how to handle.

[ffMathy]

Make a pull request against this repo for it!

[kanadaj]

There we go. Definitely avoid pulling it into Dev before checking against an ES 6.X server if the Elasticsearch.Net V7 SDK works at all. #249

[ffMathy]

ES7 for NEST is now GA! So we should really get this merged I think.

[mivano]

@Mpdreamz do you already have some clarity on the ES support?

[kvanska]

any news on this?

[Mpdreamz]

Hey all, now that the client is GA I want to focus on getting the sink to 7.0 as well by looking at

#249

And help take it to completion.

[kanadaj]

@Mpdreamz just a quick check, is the 7.0 GA client still netstandard 2.0 only (support for earlier versions now dropped?)?

[ffMathy]

I guess this can be closed now right?