Does Graylog allow non-syslog log levels?

Graylog Central (peer support)
1

I’m using a GELF input to forward my logs into Graylog, but I figured out that if I use a level key with value other than the 0-7 interval (The one GELF payload specification mentions), Graylog accepts it and is okay with that.

Also according to this and this it seems that there is no special way in the way Graylog handles this field and it is like any other fields to it. Is this correct?

Is the optionality of this field has made it to be able to have arbitrary values? Is it also valid in non-Graylog usages of GELF?

2

Yes graylog normally use level as normal field, and if you want to convert level to syslog text specification, you can either use extractor, pipeline rule or decorator.

1 Like
3

Thanks.
Does this rule apply also to the GELF standard (and not only the Graylog implementation)?
As the level field is optional, can we assume that we can set any arbitrary value for it and using the mentioned syslog levels is not a MUST? (I mean, in GELF libraries, other logging platforms that accept GELF, etc.)

4

As level field is intented for purpose of severity, it is not recommended to use it for another usage. Also libraries use level field for this:


https://www.rubydoc.info/github/graylog-labs/gelf-rb/GELF/Levels

I would suggest to use custom field e.g "_app_level" to use own level from application if it’s differs from level (0-7).

5

Thank you.
I didn’t mean using for another usage. I meant using it in another way that GELF specification expects (0-7). But the last line of your comment fixed my ambiguity.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.