GELF UDP syslog format

Graylog Central (peer support)
1

I am forwarding from couple of servers (rsyslog forwarding) through FluentD (gelf input plugin) daemon to Graylog2 using the standard setup and noticed that the messages coming through are with the below content:

message
1 2017-08-24T23:25:01.737373+03:00 host-0 CRON 29720 - - pam_env(cron:session): Unable to open env file: /etc/default/locale: No such file or directory

It seems gelf protocol adds additional info. Can I strip that somehow? Is it a valid gelf addition or I have something configured wrongly? Thanks in advance.

2

This looks like a normal RFC 5424 syslog message stripped of the priority (PRI) field.

GELF or Graylog isn’t adding anything, it’s one of the programs you’ve configured to forward these messages to Graylog.

Any reason you’re not using a Syslog UDP or TCP input for this?

3

Thanks jochen :slight_smile:

We evaluate fluentd because it has very useful filters. Will try different approaches. Thanks again.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.