Example use cases
Performance
Live demo
Stability
Graylog Extended Log Format
The Graylog Extended Log Format (GELF) avoids the shortcomings of classic plain syslog:
- Limited to length of 1024 byte - Not much space for payloads like backtraces
- Unstructured. You can only build a long message string and define priority, severity etc.
Syslog is okay for logging system messages of you servers. Use it for that. GELF instead is great for logging from within applications. It is a good practice to send GELF messages directly from your existing logging classes so it is very easy to integrate into existing applications. You could use GELF to send every exception as a log message to your Graylog2 server. You don't have to care about timeouts, connection problems or anything that might break your application from within your logging class because GELF is sent via UDP. The disadvantage of this fire and forget principle is of course that no one garantuees that your GELF message will ever arrive. I'd say that important messages will just occur again. TCP support for those who like it is coming though.
Libraries
There is an official PHP and Ruby library to send GELF messages. There are also libraries and appenders written by users:
- log4r-gelf (Log4r)
- gelf4j (Java & Log4j)
- gelfj (Java & Log4j)
- graypy (Python)
- gelf4net (.NET log4net)
- node-graylog (node.js)
- gelf-node (node.js)
- gelf-stream (node.js/Bunyan)
- logback-gelf (Logback plugin)
- log4perl_gelf (Perl/Log4Perl)
- NLog (.NET, Silverlight, Windows Phone/NLog)
- graylog2-resque (Resque failure handler plugin)
- journal2gelf (systemd to GELF)
- log4php-graylog2 (PHP log4php)
- graylog-golang (Golang / Go)
- go-gelf (Golang / Go)
Structure
The GELF specs are in the wiki: https://github.com/Graylog2/graylog2-docs/wiki/GELF
Chunked GELF
UDP datagrams are limited to a size of 8192 byte. A lot of GZIP'd information is fitting in there but you sometimes might just have more information to send. This is why Graylog2 supports chunked GELF. You can define chunks of messages by prepending a byte header to a GELF message including a GELF ID for backwards compatibilty, a message ID and sequence count/number to reassemble the message later. This feature is supported by my gelf-php and gelf-rb libraries and will be documented soon. The library will detect if the message is too long and will perform the chunking itself. More information in the wiki: https://github.com/Graylog2/graylog2-docs/wiki/GELF
Rack/Rails exception tracking
This Rack middleware gem makes it very easy to log all your Rack/Rails exceptions to a Graylog2 server. Installation and configuration guide is in it's wiki