# How to send structured logs to GELF?

**URL:** <https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635>\
**Category:** Graylog Central (peer support)\
**Created:** [March 19, 2018, 8:04pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635 "2018-03-19T20:04:50Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![WoJ](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/woj/32/1313_2.png) [@WoJ](https://community.graylog.org/u/WoJ)\
**Post date:** [March 19, 2018, 8:04pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/1 "2018-03-19T20:04:50Z")

</div>

Hello

I have JSON-formatted payload I would like to send to GELF. Is this a built-in feature?.

I tried to add a `_payload` field with JSON data but even when I hinted graylog that this is JSON, it failed parsing a table (list).

---

<div class="post-metadata">

**Author:** ![WoJ](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/woj/32/1313_2.png) [@WoJ](https://community.graylog.org/u/WoJ)\
**Post date:** [March 19, 2018, 8:28pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/2 "2018-03-19T20:28:38Z")

</div>

I just found the solution: [http://docs.graylog.org/en/2.3/pages/extractors.html#using-the-json-extractor](http://docs.graylog.org/en/2.3/pages/extractors.html#using-the-json-extractor)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 19, 2018, 8:29pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/3 "2018-03-19T20:29:41Z")

</div>

GELF itself is already a structured log format, so the ideal way would be to use GELF itself for sending your structured logs instead of putting JSON into a single text field and extract that with a JSON extractor in Graylog.

---

<div class="post-metadata">

**Author:** ![WoJ](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/woj/32/1313_2.png) [@WoJ](https://community.graylog.org/u/WoJ)\
**Post date:** [March 20, 2018, 10:00am UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/4 "2018-03-20T10:00:58Z")

</div>

I am not sure I understand: the documentation states that

> `_[additional field]` string (UTF-8) or number

So as far as I understand, the only way to add structured information is to stringify the JSON payload, send it as an additional field and have it decoded by graylog on the server.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 20, 2018, 10:02am UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/5 "2018-03-20T10:02:34Z")

</div>

[http://docs.graylog.org/en/2.4/pages/gelf.html#example-payload](http://docs.graylog.org/en/2.4/pages/gelf.html#example-payload)

> ```auto
> {
> "version": "1.1",
> "host": "example.org",
> "short_message": "A short message that helps you identify what is going on",
> "full_message": "Backtrace here\n\nmore stuff",
> "timestamp": 1385053862.3072,
> "level": 1,
> "_user_id": 9001,
> "_some_info": "foo",
> "_some_env_var": "bar"
> }
> 
> ```

Looks pretty structure to me. 😉

---

<div class="post-metadata">

**Author:** ![WoJ](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/woj/32/1313_2.png) [@WoJ](https://community.graylog.org/u/WoJ)\
**Post date:** [March 20, 2018, 10:06am UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/6 "2018-03-20T10:06:28Z")

</div>

Yes it is nicely structured 🙂

But then how to send this extra payload?

```
{
  "name": "john",
  "children": ["mary", "joe"],
  "pets": {
    "dogs": [1, 2, 3],
    "elephants": true
  }
}
```

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 20, 2018, 10:57am UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/7 "2018-03-20T10:57:10Z")

</div>

```auto
{
  "version": "1.1",
  "host": "example.org",
  "short_message": "A short message that helps you identify what is going on",
  "full_message": "Backtrace here\n\nmore stuff",
  "timestamp": 1385053862.3072,
  "level": 1,
  "_name": "john",
  "_children_1": "mary",
  "_children_2": "joe",
  "_pets_dogs_1": 1,
  "_pets_dogs_3": 2,
  "_pets_dogs_2": 3,
  "_pets_elephants": "true"
}

```

---

<div class="post-metadata">

**Author:** ![WoJ](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/woj/32/1313_2.png) [@WoJ](https://community.graylog.org/u/WoJ)\
**Post date:** [March 20, 2018, 12:07pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/8 "2018-03-20T12:07:49Z")

</div>

I see, thanks.

I found the same kind of expansion when i sent my data to graylog and had it deserialize them. Underscores were added in the same way you did it.

Retrospectively, the root of my question was rather about the capacities to keep a structured, multilevel data format. I am used to Elasticsearch and was expecting to find in graylog its way of handling structures (= having the capacity to address elements such as `pets.elephants`.  
I now understand that the data must be flattened in any case.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 20, 2018, 1:22pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/9 "2018-03-20T13:22:41Z")

</div>

Unfortunately Graylog doesn’t support nested documents yet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 3, 2018, 1:22pm UTC](https://community.graylog.org/t/how-to-send-structured-logs-to-gelf/4635/10 "2018-04-03T13:22:54Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.