GELF and nested JSON

Graylog Central (peer support)
1

Hi,

I was directed here from Twitter (https://twitter.com/PCzanik/status/938797812036390912). Do I see well, that GELF does not have direct support for nested JSON?

graylog
graylog.png1413×672 59.4 KB

The nested parts (_journal and _sudo) are left in JSON format. Of course I can attach an extractor to the fileds one by one but it’s not really practical.

Nested JSON seems to work fine if I create a raw TCP input and add a JSON extractor to it. It finds all fields automagically.

BTW: these are the results of my experiments with the new graylog2() destination and GELF template released with syslog-ng version 3.13 last week.

Peter

2

I collected my experiences with syslog-ng sending logs to Graylog in a blog:

I’m happy to correct it if there is an automated way of extracting fields from nested JSON in GELF :slight_smile:

Peter

3

That’s correct.

The only “datatypes” GELF knows of a strings and numbers as defined in the GELF 1.1 specification:
http://docs.graylog.org/en/2.3/pages/gelf.html#gelf-payload-specification