How to send structured logs to GELF?

Graylog Central (peer support)
1

Hello

I have JSON-formatted payload I would like to send to GELF. Is this a built-in feature?.

I tried to add a _payload field with JSON data but even when I hinted graylog that this is JSON, it failed parsing a table (list).

2

I just found the solution: http://docs.graylog.org/en/2.3/pages/extractors.html#using-the-json-extractor

3

GELF itself is already a structured log format, so the ideal way would be to use GELF itself for sending your structured logs instead of putting JSON into a single text field and extract that with a JSON extractor in Graylog.

4

I am not sure I understand: the documentation states that

_[additional field] string (UTF-8) or number

So as far as I understand, the only way to add structured information is to stringify the JSON payload, send it as an additional field and have it decoded by graylog on the server.

5

http://docs.graylog.org/en/2.4/pages/gelf.html#example-payload

{
  "version": "1.1",
  "host": "example.org",
  "short_message": "A short message that helps you identify what is going on",
  "full_message": "Backtrace here\n\nmore stuff",
  "timestamp": 1385053862.3072,
  "level": 1,
  "_user_id": 9001,
  "_some_info": "foo",
  "_some_env_var": "bar"
}

Looks pretty structure to me. :wink:

6

Yes it is nicely structured :slight_smile:

But then how to send this extra payload?

{
  "name": "john",
  "children": ["mary", "joe"],
  "pets": {
    "dogs": [1, 2, 3],
    "elephants": true
  }
}
7 
{
  "version": "1.1",
  "host": "example.org",
  "short_message": "A short message that helps you identify what is going on",
  "full_message": "Backtrace here\n\nmore stuff",
  "timestamp": 1385053862.3072,
  "level": 1,
  "_name": "john",
  "_children_1": "mary",
  "_children_2": "joe",
  "_pets_dogs_1": 1,
  "_pets_dogs_3": 2,
  "_pets_dogs_2": 3,
  "_pets_elephants": "true"
}
8

I see, thanks.

I found the same kind of expansion when i sent my data to graylog and had it deserialize them. Underscores were added in the same way you did it.

Retrospectively, the root of my question was rather about the capacities to keep a structured, multilevel data format. I am used to Elasticsearch and was expecting to find in graylog its way of handling structures (= having the capacity to address elements such as pets.elephants.
I now understand that the data must be flattened in any case.

9

Unfortunately Graylog doesn’t support nested documents yet.

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.