Guilherme Azeredo

← All projects

Internship · Feb — Jun 2025

Observability at Ediprinter

Internship project: a centralised logging, alerting and monitoring platform with Serilog and the Elastic Stack for EDIGCIA, Ediprinter's management software for vehicle inspection centres.

Internal company work: there is no public code. This page describes the approach as documented in my internship report.

Problem

EDIGCIA is around 16 years old and is moving from an ASP.NET MVC application (.NET Framework 4.8) to .NET Core microservices, with both running side by side. Logs were scattered and checked server by server, with no global view and no alerts.

Context and motivation

The internship, titled "Integration of Observability Tools", aimed to give the team one place to search logs, get alerted about anomalies and follow performance — set up so it could serve both the monolith and the new services.

What I built

I compared the options (Elastic, Splunk, Graylog, Datadog), integrated Serilog into the application, set up the stack with Docker Compose, and built the dashboards, alerts, access profiles and retention policy. I also ran the validation tests and documented everything in the company wiki. I worked with a supervisor at the company and an academic supervisor.

Observability platform

  1. 01 Application

    • EDIGCIA — ASP.NET MVC (.NET Framework 4.8)
    • .NET Core microservices

  2. 02 Collection

    • Serilog → JSON with client, service, environment and correlation ID
    • Global exception middleware
    • Elastic APM agent
    • Filebeat and Heartbeat

  3. 03 Storage

    • Elasticsearch
    • ILM: hot → warm → cold

  4. 04 Read and respond

    • Kibana data views and dashboards
    • Alert rules → email to technicians
    • Spaces: administrator, technician, client

The whole stack runs on Docker Compose: one command, persistent volumes.

Architecture set up during the internship, as described in the internship report.

Technical decisions

5

Elastic Stack rather than a paid service

Splunk and Datadog costs grow with data volume. Elastic is open source, runs on the company's own infrastructure and can be adapted per client — at the cost of a heavier initial setup.

Structured, enriched logs at the source

Serilog writes JSON logs straight to Elasticsearch, each tagged with client, service, environment, log type and a correlation ID. A global middleware catches unhandled exceptions and logs them with the same context, so logs can be filtered per client or followed across services.

The whole stack in one docker-compose.yml

Elasticsearch, Kibana, APM Server, Fleet Server, Filebeat and Heartbeat start with one command, with persistent volumes so logs survive restarts.

Access by profile

Separate Kibana roles and spaces for administrators, technicians and clients: technicians get the diagnostic tools; clients only see what concerns them, with less complexity.

Retention in phases

An ILM policy moves indices from hot to warm and then cold as they age, balancing storage cost against query speed.

What it does

  • Structured logging with Serilog in EDIGCIA
  • Kibana data views, filters and dashboards
  • Alert rules for exceptions, failed logins and warning/error logs, with automatic email to technicians for high-severity cases
  • Kibana spaces and roles for administrators, technicians and clients
  • ILM policy for the log lifecycle
  • Elastic APM: application transactions, errors and metrics

Evidence

what was checked, and how
WhatResultSourceChecked
ValidationLog ingestion, data views and alerts tested against several scenariosInternship report, IPCA 2024/25
Status at the endRunning in a local environment on internal logsInternship report, chapter 6

Limitations and next steps

Known limitations

  • At the end of the internship the platform was deployed in a local environment, monitoring Ediprinter's internal logs; it was not yet available to clients.
  • Because this is internal work, no code, configuration or screenshots of real data are published.

Next steps

  • Extend monitoring to infrastructure metrics, external services and security logs
  • Distributed tracing across microservices
  • Field-level security and integration with the company's authentication
  • Business-facing dashboards and automatic client reports