Logging to ELK using Log4Net and a UDP appender

At one of my clients we used the Elastic stack (ELK) to log information from a system and visualise it using Kibana. I found it very useful and I wondered whether the same can be done for a .NET application using Log4Net.

Since we already have lots of logging using Log4Net it only makes sense to use the same infrastructure. In other words, the aim is to use a standard Log4Net appender to send our logging information to Logstash. In this case, the UdpAppender.

In order to log information to ELK using the Log4Net UdpAppender we have to ensure that Logstash listens on a UDP port.

To configure Logstash to listen on a UDP port

  1. Open the Logstash configuration file, for example, bin\config.js
  2. Add a new input type, UDP and save the file, for example:
input { 
  udp {
    port => 5960
    codec => plain { charset => "UTF-8" }
    type => "log4net"
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }

Note: Remember to restart the Logstash service in order for it to read the new configuration.

Next, we need to update the Log4Net configuration in the application to use the new UdpAppender.

To configure Log4Net to send log information to Logstash

  1. Add a new UdpAppender in the application configuration file and ensure that the remote address and port number of the Logstash server matches, for example
  <appender name="UdpAppender" type="log4net.Appender.UdpAppender">
    <RemoteAddress value="" />
    <RemotePort value="5960" />
    <layout type="log4net.Layout.PatternLayout">
      <conversionPattern value="%date [%thread] %-5level - %property{log4net:HostName} - SomeApplication - %logger - %message%newline" />
    <level value="ALL" />
    <appender-ref ref="UdpAppender" />

After we send a couple of log entries we should start seeing them appear in Kibana.