Why are Serilog LogWarning messages labeled as Information in Azure App Service Log Stream?

Question

I'm using Serilog in an ASP.NET Core Web API app deployed to Azure App Service.

My logger configuration includes writing to the console with JsonFormatter:

           var loggerConfig = new LoggerConfiguration()
               .Enrich.WithMachineName()
               .Enrich.FromLogContext()
               .WriteTo.Console(new JsonFormatter())
         	   .WriteTo.File("logs/log-.txt", rollingInterval: RollingInterval.Day)
           	   .CreateLogger();

I also call UseSerilog() in Program.cs, and everything logs fine both locally and in Azure. The logs appear in the Azure App Service Log Stream as expected.

However, I’ve noticed this strange behavior:

Log messages written at LogWarning level appear in the log stream, but they’re labeled as Information level. Here’s an example output from the log stream (JSON format):

2025-05-20T13:38:52.377176Z {"Timestamp":"2025-05-20T13:38:52.3770112+00:00","Level":"Warning","MessageTemplate":"No deployment methods

I'm logging a warning like this: _logger.LogWarning("No deployment methods found") when i filter by selecting Warning LogLevel , no logs found

What I've tried:

• Switched between JsonFormatter() and CompactJsonFormatter()

here is my app.settings.json

  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },

Answer 1

Hi Saad SBAT,

I have modified your code by adding Console sink to appear logs in the Log Stream of a Linux App service.

configuration.WriteTo.Console();

Program.cs :

using Microsoft.ApplicationInsights.Extensibility;
using Microsoft.Extensions.Options;
using Serilog;
using Serilog.Events;

var builder = WebApplication.CreateBuilder(args);

builder.Host.ConfigureServices(services =>
{
    services.AddApplicationInsightsTelemetry();
});

builder.Host.ConfigureLogging(logging =>
{
    logging.ClearProviders();
    logging.AddAzureWebAppDiagnostics(); 
});

builder.Host.UseSerilog((context, services, configuration) =>
{
    configuration
        .Enrich.FromLogContext()
        .MinimumLevel.Override("Microsoft.AspNetCore", LogEventLevel.Warning)
        .ReadFrom.Configuration(context.Configuration)
        .ReadFrom.Services(services);
    var telemetryConfiguration = services.GetService<IOptions<TelemetryConfiguration>>();

    if (!string.IsNullOrEmpty(telemetryConfiguration?.Value.ConnectionString))
    {
        configuration.WriteTo.ApplicationInsights(telemetryConfiguration.Value, TelemetryConverter.Traces);
    }

    if (!context.HostingEnvironment.IsDevelopment())
    {
        configuration.WriteTo.File(
            $"/home/LogFiles/{context.HostingEnvironment.ApplicationName}.txt",
            fileSizeLimitBytes: 1048576,
            rollOnFileSizeLimit: true,
            retainedFileCountLimit: 3,
            shared: true,
            flushToDiskInterval: TimeSpan.FromSeconds(1)
        );
    }
    configuration.WriteTo.Console();
});

builder.Services.AddControllers();
var app = builder.Build();
app.UseAuthorization();
app.MapControllers();
app.Run();

WeatherForecastController.cs :

        [HttpGet]
        public IEnumerable<string> Get()
        {
            _logger.LogInformation("Weather forecast requested at {time}", DateTime.UtcNow);
            _logger.LogWarning("A warning has appeared");
            _logger.LogError("An error has occurred");
            return new[] { "Sunny", "Cloudy", "Rainy" };
        }
    }

appsettings.json :

{
  "ApplicationInsights": {
    "ConnectionString": "<AppInsightsConneString>"
  },
  "Serilog": {
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft.AspNetCore": "Warning"
      }
    },
    "Enrich": [ "FromLogContext" ]
  }
}

Log Stream :

I successfully got the logs.

If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.