You need to pass in a configuration instance when registering the sink. In the constructor you need to pass in at least a uri where the Elasticsearch server is running. This is in the form of https://localhost:9200 for example.

You can also pass in multiple addresses and the internal Elasticsearch.net library will use all the addresses and connect to the first one responding. When this instance fails to respond it will automatically switch to the other ones listed. Use this to provide higher availability for your Elasticsearch endpoints.

var sink = new ElasticsearchSink(new ElasticsearchSinkOptions(new[] { new Uri("https://server1:9200"), new Uri("https://server2:9200") }));

Note: some of the options can be set using the appSettings reader.

  <appSettings>
    <add key="serilog:using" value="Serilog.Sinks.Elasticsearch"/>
    <add key="serilog:write-to:Elasticsearch.nodeUris" value="https://localhost:9200;https://remotehost:9200"/>
    <add key="serilog:write-to:Elasticsearch.indexFormat" value="custom-index-{0:yyyy.MM}"/>
    <add key="serilog:write-to:Elasticsearch.templateName" value="myCustomTemplate"/>
  </appSettings>

With the appSettings configuration the nodeUris property is required. Multiple nodes can be specified using , or ; to separate them. All other properties are optional.

You can set the following options in the ElasticsearchSinkOptions instance that you pass to the sink.