I am forwarding from couple of servers (rsyslog forwarding) through FluentD (gelf input plugin) daemon to Graylog2 using the standard setup and noticed that the messages coming through are with the below content:
1 2017-08-24T23:25:01.737373+03:00 host-0 CRON 29720 - - pam_env(cron:session): Unable to open env file: /etc/default/locale: No such file or directory
It seems gelf protocol adds additional info. Can I strip that somehow? Is it a valid gelf addition or I have something configured wrongly? Thanks in advance.