structured logging - Escaping special characters for ${all-event-properties} layout renderer

[bslbckr]

We use syslog with structured logging according to rfc5424 in order to send our logmessages. Within our layout we use the ${all-event-properties} layout renderer. One of the values provided to a property appears to contain some quotation marks, which - to be compatible to rfc5424 - must be escaped. Unfortunately, this does not seem to happen or we are unable to configure it correctly.

Here is the relevant snippet from our nlog.config:

<targets>
        <target xsi:type="Syslog" name="syslog-tcp">
          <!--intentionaly empty, because we log structured data only-->
          <sl:layout xsi:type="SimpleLayout" text="" />
          <sl:messageCreation>
            <sl:facility>Local4</sl:facility>
            <sl:rfc>Rfc5424</sl:rfc>}
            <sl:rfc5424>
              <sl:hostname xsi:type="SimpleLayout" text="${machinename}" />
              <sl:appName xsi:type="SimpleLayout" text="${projectname}" />
              <sl:procId xsi:type="SimpleLayout" text="${processid}" />
              <sl:msgId xsi:type="SimpleLayout" text="${threadid}" />
              <sl:disableBom>true</sl:disableBom>
              <sl:structuredData>
                <!--See [https://tools.ietf.org/html/rfc5424#section-6.3 ](https://tools.ietf.org/html/rfc5424#section-6.3) for structured loggin guidance-->
                <sl:fromEventProperties xsi:type="SimpleLayout" text='[mdlc@0 requestId="${mdlc:item=RequestID}"][message@0 msgTemplate="${message:raw=true}" ${all-event-properties:format=[key]="[value]":separator= :includeEmptyValues=true}][exception@0 type="${exception:format=type}" message="${exception:format=message}" stackTrace="${exception:format=StackTrace:innerFormat=StackTrace:maxInnerExceptionLevel=4}"]'/>
              </sl:structuredData>
            </sl:rfc5424>
          </sl:messageCreation>
          <sl:messageSend>
            <sl:protocol>tcp</sl:protocol>
            <sl:tcp server="..." port="514" />
          </sl:messageSend>
          <sl:enforcement>
            <sl:replaceInvalidCharacters>true</sl:replaceInvalidCharacters>
          </sl:enforcement>
        </target>
      </targets>

The log statement looks like:

_logger.LogInformation("github issue {status}", state);

where state.ToString() yields something like: Status(StatusCode="OK", Detail="")

The logged message contains exactly this string representation instead of the expected: Status(StatusCode=\"OK\", Detail=\"\")

Is this a bug or an configuration issue?

[snakefoot]

Maybe one could use JsonLayout instead:

<sl:structuredData>
     <sl:fromEventProperties>
            <layout xsi:type="JsonLayout" includeEventProperties="true">
                  <attribute name="requestId" layout="${mdlc:item=RequestID}" />
                  <attribute name="msgTemplate" layout="${message:raw=true}" />
                  <attribute name="type" layout="${exception:format=type}" />
                  <attribute name="message" layout="${exception:format=message}" />
                  <attribute name="stackTrace" layout="${exception:format=tostring}" />
            </layout>
     </sl:fromEventProperties>
</sl:structuredData>

Or if you need funky SysLog-format, then maybe try using CompoundLayout to concat several JsonLayout's into single output.

Yet another alternative is creating your own custom layoutrenderer, and have complete control.