I was directed here from Twitter (https://twitter.com/PCzanik/status/938797812036390912). Do I see well, that GELF does not have direct support for nested JSON?
The nested parts (_journal and _sudo) are left in JSON format. Of course I can attach an extractor to the fileds one by one but it’s not really practical.
Nested JSON seems to work fine if I create a raw TCP input and add a JSON extractor to it. It finds all fields automagically.
BTW: these are the results of my experiments with the new graylog2() destination and GELF template released with syslog-ng version 3.13 last week.