GELF and nested JSON

(Peter Czanik) #1


I was directed here from Twitter ( Do I see well, that GELF does not have direct support for nested JSON?

The nested parts (_journal and _sudo) are left in JSON format. Of course I can attach an extractor to the fileds one by one but it’s not really practical.

Nested JSON seems to work fine if I create a raw TCP input and add a JSON extractor to it. It finds all fields automagically.

BTW: these are the results of my experiments with the new graylog2() destination and GELF template released with syslog-ng version 3.13 last week.


(Peter Czanik) #2

I collected my experiences with syslog-ng sending logs to Graylog in a blog:

I’m happy to correct it if there is an automated way of extracting fields from nested JSON in GELF :slight_smile:


(Jochen) #3

That’s correct.

The only “datatypes” GELF knows of a strings and numbers as defined in the GELF 1.1 specification:

(system) closed #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.