Serilog expression to exclude http 200 and http 302?-CodePudding

I'm using serilog and it's nicely logging http requests to my asp.net core web application.

However I want to filter out the noise of http 200 and http 302 (basically only interested in 5xx and 4xx).

I've tried a lot of variations on the following:

... snip ...
"Using": [ "Serilog.Expressions" ],
"Filter": [
  {
    "Name": "ByExcluding",
    "Args": {
      "expression": "@l = 'Information' and Properties.StatusCode in ['200', '302']"
    }
  }
],
... snip ...

But to no success.

The LogEvent properties looks like (:

{
  "TimeStamp": "2021-12-09T09:00:18.1586954",
  "Level": "Information",
  "Message": "HTTP \"GET\" \"/xxx/yyy\" responded 200 in 50.2048 ms",
  "MessageTemplate": "HTTP {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms",
  "Properties": {
    "RequestMethod": "GET",
    "RequestPath": "/xxx/yyy",
    "StatusCode": 200,
    "Elapsed": 50.2048,
    "SourceContext": "Serilog.AspNetCore.RequestLoggingMiddleware",
    "RequestId": "8000050f-0006-eb00-b63f-84710c7967bb"
  },
  "Renderings": {
    "Elapsed": [
      {
        "Format": "0.0000",
        "Rendering": "50.2048"
      }
    ]
  }
}

Serilog is paying attention if I use a filter like "@l = 'Information'", but any attempt to filter based upon LogEvent properties does not work.

Any help would be appreciated!

CodePudding user response：

Serilog.Expressions doesn't require dotting through a Properties subobject: all of the event's properties are top-level names.

StatusCode is also a number, not a string, so you don't need quotes within the array of status code values to exclude.

Your expression should look like:

@l = 'Information' and StatusCode in [200, 302]