输入如下

...,
"message": [
      ",{\"Timestamp\":\"2022-07-10T15:19:26.5172555Z\",\"Level\":\"Error\",\"MessageTemplate\":\"this is an error\",\"RenderedMessage\":\"this is an error\",\"Properties\":{\"RequestId\":\"0HMJ2FOA0IL5B:00000002\",\"RequestPath\":\"/\",\"ConnectionId\":\"0HMJ2FOA0IL5B\"}}\r"
],
...

我尝试了以下方法：

filter {
    split {
        field => "message"
    }
}

和

filter {
    json {
        source => "message"
    }
}

我认为它的格式可能有问题，因为消息字符串的开头有一个逗号,
下面是我为测试这一点而制作的最小API的一个示例

using Elastic.CommonSchema.Serilog;
using Serilog;

var builder = WebApplication.CreateBuilder(args);
builder.Host
    .UseSerilog((ctx, lc) => lc
        .WriteTo.Http(textFormatter: new EcsTextFormatter(), requestUri: "http://localhost:5000", queueLimitBytes: null)
        .Enrich.FromLogContext()
    );

var app = builder.Build();
app.MapGet("/", (Serilog.ILogger logger) =>
{
    logger.Error("this is an error");
    return "logged an error";
});
app.Run("http://localhost:3000");