Graylog2: Can a custom GELF field accept a JSON object

Question

I was just reading the GELF spec as I'm integrating it into our system. I was just wondering if an additional/custom field can contain a JSON object as the spec doesn't mention it:

So my GELF output (in particular the _request field below) would look something like:

{
  "version": "1.0",
  "host": "www1",
  "short_message": "Short message",
  "full_message": "Backtrace here\n\nmore stuff",
  "timestamp": 1291899928,
  "level": 1,
  "facility": "payment-backend",
  "file": "/var/www/somefile.rb",
  "line": 356,
  "_request": {
      "ip": "123.123.123.123",
      "url": "example.com/dir/file.ext",
      "method": "get",
      "referer" "example.net"
}

score 3 · Accepted Answer · edited Jan 29 '15 at 12:34

3

Currently GELF doesn't support nested JSON objects however if anyone is interested please comment at groups.google.com/forum/#!topic/graylog2/Xg3v3Qh8fmo.

edited Jan 29 '15 at 12:34

tomzx

163
9

answered May 06 '12 at 16:18

Sean Bannister

741
8
19

score 1 · Answer 2 · answered Feb 24 '12 at 22:29

1

I think it is better to avoid such nested structures, it will just complicate things. You can flatten it out and put this into the JSON instead:

_request_ip
_request_url
_request_method
_request_referer

answered Feb 24 '12 at 22:29

b0ti

986
1
6
13

I had considered this however for complex stack traces it would make sense to include it as a JSON object and would make it much simpler to read. So I was wondering if the GELF standard allows for this? I'm not a Graylog2 user so I'm not sure if it even supports it but I did want to make my application compatible. – Sean Bannister Feb 25 '12 at 05:43
Hey Sean, please post this as a suggestion on the Graylog2 mailing list, so we can discuss this! – Lennart Mar 09 '12 at 14:45
@Lennart Cheers, posted it at https://groups.google.com/forum/#!topic/graylog2/Xg3v3Qh8fmo – Sean Bannister Mar 10 '12 at 12:42

Graylog2: Can a custom GELF field accept a JSON object

2 Answers2