Problem: Containers are using GELF UDP with log-driver=gelf. Using a TCP dump the json sent do graylog was:
{
“version”: “1.1”,
“host”: “dev-graylog-asg”,
“short_message”: “TESTE12345”,
“timestamp”: 1562273526.271,
“level”: 6,
“_command”: “echo TESTE12345”,
“_container_id”: “xxxx”,
“_container_name”: “xxxxxx”,
“_created”: “2019-07-04T20:52:05.970041461Z”,
“_image_id”: “sha256:xxxx”,
“_image_name”: “xxxx”,
“_tag”: “062498dd73e0”
}
However, only message field appears on graylog UI, with “TESTE12345” string. Should short_message be displayed instead?
All other fields, are show as expected.
If I send this json directly to graylog with nc command, all fields are indexed and short_message get the correct value.
Tks.