Graylog 3 - Docker Log Driver - Only message field on graylog

Problem: Containers are using GELF UDP with log-driver=gelf. Using a TCP dump the json sent do graylog was:

“version”: “1.1”,
“host”: “dev-graylog-asg”,
“short_message”: “TESTE12345”,
“timestamp”: 1562273526.271,
“level”: 6,
“_command”: “echo TESTE12345”,
“_container_id”: “xxxx”,
“_container_name”: “xxxxxx”,
“_created”: “2019-07-04T20:52:05.970041461Z”,
“_image_id”: “sha256:xxxx”,
“_image_name”: “xxxx”,
“_tag”: “062498dd73e0”

However, only message field appears on graylog UI, with “TESTE12345” string. Should short_message be displayed instead?

All other fields, are show as expected.

If I send this json directly to graylog with nc command, all fields are indexed and short_message get the correct value.


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.