EcsTextFormatter use of BaseStream results in unbuffered writes which causes out of order writes to file in Serilog

[Jhaiii]

When writing the formatted json to a Serilog Durable Http Sink (Serilog.Sinks.Http), the log is corrupted as a BOM is written after the first log rather than as the first bytes of the file. The Http Sink in turn uses a file sink to store the buffer before shipping to http endpoint (Logstash in my case). Logstash cannot process the logs due to an embedded BOM.

The cause of the issue comes down to the EcsTextFormatter writing directly to the base stream rather than the buffer. When the Serilog File Sink flushes the buffer for the first time, the BOM is written after the first log rather than being the first bytes.

ecs-dotnet/src/Elastic.CommonSchema.Serilog/EcsTextFormatter.cs

Line 29 in d64e2fd

ecsEvent.Serialize(sw.BaseStream);

Please see Issue raised on Serilog project where this was discussed, prior to coming to conclusion that EcsTextFormatter should be modified.

To prove this, changing the code to below results in the correct sequence of writes:
output.Write(ecsEvent.Serialize());

[russcam]

Thanks for opening @Jhaiii, looking at now