GELF - Graylog Extended Log Format

The Graylog2 server listens on the UDP port you specified in graylog2.conf (gelf_listen_port) for new GELF messages. GELF is a simple JSON string that allows you to send long and structured syslog messages and very useful for customized application log monitoring.

GELF libraries

I wrote a ruby library for GELF that you can use or study:

• gelf-rb

More (PHP, Java, ...) to be written.

JSON structure

• short_message
  • A short descriptive message
• full_message
  • A long message that can i.e. contain a stacktrace or environment variables
• level
  • The log level. Equal to the standard syslog levels.
• host
  • The name of the host that sent this message
• type
  • A type as integer. Currently not used.
• line
  • The line in a file that caused the error.
• file
  • The filename (with path if you want) that caused the error.

You can set everything except short_message and host to NULL.

The whole JSON string must be sent gzipped and must not be longer than 4096 byte.

Example

{"full_message":"Stacktrace here","line":356,"level":1,"type":null,"short_message":"Short message","file":"somefile.rb","host":"localhost"}