DurableHttpSink sometimes splits log events in wrong place

It looks like DurableHttpSink has some multithreading issue. We have a netcoreapp2.0 service with quite big load and it is using DurableHttpSink for sending logs to logstash.

Sometimes it happens so that events are split in the middle somehow and logstash is unable to deserialize it as JSON.

Serilog sink is configured using configuration file as:

      {
        "Name": "DurableHttp",
        "Args": {
          "requestUri": "http://logstash:30000/DEV/Service",
          "bufferPathFormat": "C:/Logs/Service/Buffer-{Hour}.json"
        }
      }

Service is running under Windows Server behind IIS. Sometimes we have logged events which are ending in the middle and continued in next logstash event. For example: one event is ending like:

{"events": [{"Timestamp": "2018-09-10T05:01:32.9541105+02:00","Level": "Warning","MessageTemplate": "Using old values for service {serviceName}","RenderedMessage": "Using old values for service \"service\"","Properties": {"serviceName": "service","SourceContext": "ServiceMonitor","RequestId": "0HLGECVV4D9FE:00003261","RequestHeaders": {"Machine]}

and next event:

{"events": [Name": "srv01", "ThreadId": 47 }]}

As you can see json in both is invalid and log even is simply split into 2. We get 2 or 3 events per day which are invalid.

For me it looks like buffer file reading before sending does not care if event is fully written. Just assuming that file reading happens at the time when writing happens, and somehow it is able to read half of even.

Using: Serilog.Sinks.Http Version=4.2.1

[FantasticFiasco]

The release is currently being validated on NuGet, it should be available within the hour.

[FantasticFiasco]

Very good! I’ll release an official fix tonight.

Thank you for reporting this issue.