GELF

Ship logs using GELF to Logstash

Follow the steps below to send your observability data to Logit.io

Logs

Configure Gelf logs to automatically send to Logstash and Elasticsearch for further log analysis with our config example below.

Install Integration

Please click on the Install Integration button to configure your stack for this source.

Send data to GELF input

Note: You need a UDP Logstash input on your Stack to be able to send GELF logs.

Sending the log to logstash with netcat:

echo '{"test_version": "1.1","test_host":"example.org","short_message":"A short message that helps you identify what is going on","test_level":1,"user_id":9001,"some_info":"foo","some_env_var":"bar"}' | gzip | nc -u -w 1 @logstash.host @logstash.port

View data

Take a look in your kibana for your message, note UDP doesnt guarantee delivery

Check Logit.io for your logs

Data should now have been sent to your Stack.

View My Data

If you don't see take a look at How to diagnose no data in Stack below for how to diagnose common issues.

How to diagnose no data in Stack

If you don't see data appearing in your stack after following this integration, take a look at the troubleshooting guide for steps to diagnose and resolve the problem or contact our support team and we'll be happy to assist.

GELF Logstash Overview

GELF (also known as Graylog Extended Log Format) is a convenient log format that was originally created to provide an alternative to using Syslog. This was done to close the gap between logging in an unstructured format versus the more easily processable structured logging format.

GELF uses a simple JSON string to send structured log messages and application data. Gelf also assists in combating the additional shortcomings that become apparent when using plain Syslog. As plain Syslog is limited to a length of 1024 bytes there is very little remaining space left for backtraces and other payloads.

Due to its support for structured logging, GELF is highly suitable for custom APM (opens in a new tab) setups. GELF log messages contain the following data fields; host, timestamp, version, long and short messages and also provides support for custom fields that can be configured as required.

If you need any additional assistance in sending GELF logs to Logstash we're here to help, simply get in touch by reaching out to the support team via live chat and we'll be happy to help you get started with sending logs and application data.

Fortigate Github