gelf

Status: beta

Read gelf messages as events over the network.

This input is a good choice if you already use graylog2 today.

The main reasoning for this input is to leverage existing GELF logging libraries such as the gelf log4j appender

Synopsis

This is what it might look like in your config file:

input {
  gelf {
    add_field => ... # hash (optional), default: {}
    debug => ... # boolean (optional)
    format => ... # ["plain", "json", "json_event"] (optional)
    host => ... # string (optional), default: "0.0.0.0"
    message_format => ... # string (optional)
    port => ... # number (optional), default: 12201
    remap => ... # boolean (optional), default: true
    tags => ... # array (optional)
    type => ... # string (required)
  }
}

Details

add_field

• Value type is hash
• Default value is {}

Add a field to an event

debug

• Value type is boolean
• There is no default value for this setting.

Set this to true to enable debugging on an input.

format

• Value can be any of: "plain", "json", "json_event"
• There is no default value for this setting.

The format of input data (plain, json, json_event)

host

• Value type is string
• Default value is "0.0.0.0"

The address to listen on

message_format

• Value type is string
• There is no default value for this setting.

If format is "json", an event sprintf string to build what the display @message should be given (defaults to the raw JSON). sprintf format strings look like %{fieldname} or %{@metadata}.

port

• Value type is number
• Default value is 12201

The port to listen on. Remember that ports less than 1024 (privileged ports) may require root to use.

remap

• Value type is boolean
• Default value is true

Whether or not to remap the gelf message fields to logstash event fields or leave them intact.

Default is true

Remapping converts the following gelf fields to logstash equivalents:

• event.message becomes fullmessage if no fullmessage, use event.message becomes shortmessage if no shortmessage, event.message is the raw json input
• host + file to event.source

tags

• Value type is array
• There is no default value for this setting.

Add any number of arbitrary tags to your event.

This can help with processing later.

type (required setting)

• Value type is string
• There is no default value for this setting.

Label this input with a type. Types are used mainly for filter activation.

If you create an input with type "foobar", then only filters which also have type "foobar" will act on them.

The type is also stored as part of the event itself, so you can also use the type to search for in the web interface.

---

This is documentation from lib/logstash/inputs/gelf.rb