GELF and nested JSON

[czanik (Peter Czanik)]

Hi,

I was directed here from Twitter (https://twitter.com/PCzanik/status/938797812036390912). Do I see well, that GELF does not have direct support for nested JSON?

The nested parts (_journal and _sudo) are left in JSON format. Of course I can attach an extractor to the fileds one by one but it’s not really practical.

Nested JSON seems to work fine if I create a raw TCP input and add a JSON extractor to it. It finds all fields automagically.

BTW: these are the results of my experiments with the new graylog2() destination and GELF template released with syslog-ng version 3.13 last week.

Peter

[czanik (Peter Czanik)]

I collected my experiences with syslog-ng sending logs to Graylog in a blog:

Graylog as destination in syslog-ng

I’m happy to correct it if there is an automated way of extracting fields from nested JSON in GELF

Peter

[jochen]

@czanik

that GELF does not have direct support for nested JSON?

That’s correct.

The only “datatypes” GELF knows of a strings and numbers as defined in the GELF 1.1 specification:
http://docs.graylog.org/en/2.3/pages/gelf.html#gelf-payload-specification