如何通过Serilog将AWS错误等库日志输出至AWS CloudWatch？

我正在开发ASP.NET 6 Web API，使用Serilog将业务日志输出至AWS CloudWatch的功能运行正常。但目前AWS SDK等库的错误日志只能保存到本地文件serilog-aws-errors.txt，导致出现「No space left on device : '/app/Logs/serilog-aws-errors.txt'」的磁盘满错误，且这些本地日志也没有同步到CloudWatch。

当前使用的appsettings配置如下：

"Serilog": {
  "Using": [ "AWS.Logger.SeriLog", "Serilog.Sinks.Console", "Serilog.Sinks.File" ],
  "MinimumLevel": "Debug",
  "WriteTo": [
    { "Name": "AWSSeriLog" },
    { "Name": "Console" },
    {
      "Name": "File",
      "Args": {
        "path": "Logs/webapi-.txt",
        "rollingInterval": "Day"
      }
    }
  ],
  "Region": "eu-west-2",
  "LogGroup": "/development/serilog",
  "LibraryLogFileName": "Logs/serilog-aws-errors.txt"
}

想知道有没有办法把serilog-aws-errors.txt中的日志输出到AWS CloudWatch或S3存储桶。

1. 禁用本地库日志，让AWS SDK日志走Serilog管道输出到CloudWatch #

LibraryLogFileName是AWS.Logger.SeriLog用来单独输出AWS SDK内部日志到本地文件的配置，直接移除这个配置，同时通过Serilog的日志级别覆盖功能控制AWS SDK日志的输出级别，就能让这些日志通过已有的AWSSeriLog sink输出到CloudWatch，彻底避免本地磁盘占用问题。

修改后的配置如下：

"Serilog": {
  "Using": [ "AWS.Logger.SeriLog", "Serilog.Sinks.Console", "Serilog.Sinks.File" ],
  "MinimumLevel": {
    "Default": "Debug",
    "Override": {
      "AWS": "Error", // 可按需调整为Debug/Info等级别
      "AWS.HttpHandler": "Error",
      "AWS.Internal": "Error"
    }
  },
  "WriteTo": [
    { "Name": "AWSSeriLog" },
    { "Name": "Console" },
    {
      "Name": "File",
      "Args": {
        "path": "Logs/webapi-.txt",
        "rollingInterval": "Day"
      }
    }
  ],
  "Region": "eu-west-2",
  "LogGroup": "/development/serilog"
}

2. 单独将AWS库日志输出到专属CloudWatch日志组或S3 #

如果需要把AWS库日志和业务日志分开管理，可以通过Serilog的过滤功能实现：

输出到CloudWatch专属日志组 #

新增一个AWSSeriLog sink，指定单独的日志组，只过滤AWS相关日志输出：

"WriteTo": [
  // 业务日志输出到原有日志组
  { "Name": "AWSSeriLog", "Args": { "LogGroup": "/development/serilog" } },
  // AWS库日志输出到专属日志组
  {
    "Name": "AWSSeriLog",
    "Args": { "LogGroup": "/development/serilog-aws-logs" },
    "Filter": [
      {
        "Name": "ByIncludingOnly",
        "Args": { "expression": "StartsWith(SourceContext, 'AWS')" }
      }
    ]
  },
  { "Name": "Console" },
  {
    "Name": "File",
    "Args": {
      "path": "Logs/webapi-.txt",
      "rollingInterval": "Day"
    }
  }
]

输出到S3存储桶 #

先安装Serilog.Sinks.S3 NuGet包，然后添加对应的sink配置，通过过滤规则只输出AWS库日志：

"WriteTo": [
  // 其他sink配置保留
  {
    "Name": "S3",
    "Args": {
      "bucketName": "your-aws-s3-bucket-name",
      "pathPrefix": "aws-logs/",
      "rollingInterval": "Day"
    },
    "Filter": [
      {
        "Name": "ByIncludingOnly",
        "Args": { "expression": "StartsWith(SourceContext, 'AWS')" }
      }
    ]
  }
]

3. 临时解决磁盘满问题 #

当前磁盘已满的情况下，先手动清理serilog-aws-errors.txt文件，或者在服务启动脚本中添加清理旧日志的逻辑，确保服务能正常运行。

内容的提问来源于stack exchange，提问作者Nuwantha