NLog.Layouts.ClefJsonLayout

An NLog layout that writes JSON in Compact Log Event Format CLEF that is compatible with Seq.

There are situations when it is not possible to send logs directly to Seq, for example, due to enterprise security policies. In this case, a Seq-compatible JSON log can be useful, which can be manually fed to Seq using seqcli ingest command.

Getting started

After installing NLog, install the NLog.Layouts.ClefJsonLayout package from NuGet:

dotnet add package NLog.Layouts.ClefJsonLayout

Then, use the ClefJsonLayout layout within the file target in your NLog configuration:

<nlog>
    <extensions>
        <add assembly="NLog.Layouts.ClefJsonLayout"/>
    </extensions>
    <targets>
        <target xsi:type="File" name="file" fileName="log.json">
            <layout xsi:type="ClefJsonLayout" />
        </target>
    </targets>
    <rules>
        <logger name="*" minlevel="Info" writeTo="file" />
    </rules>
</nlog>

Attaching additional properties

The layout declaration in NLog.config can be expanded with additional properties:

<target xsi:type="File" name="file" fileName="log.json">
    <layout xsi:type="ClefJsonLayout">
        <attribute name="logger" layout="${logger}"/>
        <attribute name="thread" layout="${threadid}"/>
    </layout>
</target>

Any properties specified here will be attached to all outgoing events. The value can be any supported layout renderer.

Acknowledgements

The layout is the part of the NLog.Targets.Seq code that is responsible for generating JSON in CLEF.