line 104 src/Sinks/AzureLogAnalytics/AzureLogAnalyticsSink.cs
Issue: Custom log structure is only available against "Event" field.
Suggestion: This package will be more flexible if log structure can be modified at the top level.
Example:
- Current limitation for log structure:
[{
"TimeGenerated": xyz,
"Event": [{Userid: x}, {EntityId: y}, {Action: z}],
"Message": "xyz"
}]
var logs = logEventsBatch.Select(s =>
{
var obj = new ExpandoObject() as IDictionary<string, object>;
obj.Add("TimeGenerated", DateTime.UtcNow);
obj.Add("Event", s);
obj.Add("Message", s.RenderMessage());
return obj;
});
- Proposed flexibility:
[{
"TimeGenerated": xyz,
"Event": [ ],
"UserId": x,
"EntityId": y,
"Action": z,
"Message": "xyz"
}]
line 104 src/Sinks/AzureLogAnalytics/AzureLogAnalyticsSink.cs
Issue: Custom log structure is only available against "Event" field.
Suggestion: This package will be more flexible if log structure can be modified at the top level.
Example:
[{
"TimeGenerated": xyz,
"Event": [{Userid: x}, {EntityId: y}, {Action: z}],
"Message": "xyz"
}]
[{
"TimeGenerated": xyz,
"Event": [ ],
"UserId": x,
"EntityId": y,
"Action": z,
"Message": "xyz"
}]