title: Serilog HTTP Sink custom formatting for Logstash
body: <p>I am using <a href="https://github.com/FantasticFiasco/serilog-sinks-http" rel="nofollow noreferrer">Serilog HTTP sink</a> for logging to Logstash in my .Net Core Project. In startup.cs I have following code to enable serilog. </p>
  
  <pre><code> Log.Logger = new LoggerConfiguration()
          .Enrich.FromLogContext()
          .WriteTo.Http("http://mylogstashhost.com:5000").Enrich.WithProperty("user", "xxx").Enrich.WithProperty("serviceName", "yyy")
          .MinimumLevel.Warning()
          .CreateLogger();
  </code></pre>
  
  <p>And this code sends logs to the given http address. I can see on fiddler that following json is being posted to the logstash and logstash returns "ok" message. </p>
  
  <pre><code>{"events":[{"Timestamp":"2018-10-19T18:16:27.6561159+01:00","Level":"Warning","MessageTemplate":"abc","RenderedMessage":"abc","user":"xxx","serviceName":"yyy","Properties":{"ActionId":"b313b8ed-0baf-4d75-a6e2-f0dbcb941f67","ActionName":"MyProject.Controllers.HomeController.Index","RequestId":"0HLHLQMV1EBCJ:00000003","RequestPath":"/"}}]}
  </code></pre>
  
  <p>But when I checked on Kibana, I can not see this log. I tried to figure out what causes it and i realized that if I send the json as following format I can see the Log.</p>
  
  <pre><code>{"Timestamp":"2018-10-19T18:16:27.6561159+01:00","Level":"Warning","MessageTemplate":"abc","RenderedMessage":"abc","user":"xxx","serviceName":"yyy","Properties":{"ActionId":"b313b8ed-0baf-4d75-a6e2-f0dbcb941f67","ActionName":"MyProject.Controllers.HomeController.Index" ,"RequestId":"0HLHLQMV1EBCJ:00000003","RequestPath":"/"}}
  </code></pre>
  
  <p>So Logstash doesnt like the event to be in Events{} and also it wants "user" and "ServiceName" tags out of "Properties". Is there a way to format my Json like this?</p>