That’s probably because you have an actual filebeat process parsing the server.log file and sending it to Graylog over a Beats input - see the file field? When you’re using the GELF appender, that field shouldn’t even be there.
Yes , I could see gelf-java appender showing file field as ? an facility field as “gelf-java”.
I take a look of the configuration it is same as other application that is collecting the logs as “gelf-java”.
I checked the inputs it is using GELF UDP not beats.
I am investing further.
Please let me know if you know a place where i can take a look.