Graylog Extended Format logging driver
Estimated reading time: 3 minutesThe gelf
logging driver is a convenient format that is understood by a number of tools such as
Graylog,Logstash, and
Fluentd. Many tools use this format.
In GELF, every log message is a dict with the following fields:
- version
- host (who sent the message in the first place)
- timestamp
- short and long version of the message
- any custom fields you configure yourself
Usage
To use the gelf
driver as the default logging driver, set the log-driver
and
log-opt
keys to appropriate values in the daemon.json
file, which is located
in /etc/docker/
on Linux hosts or C:\ProgramData\docker\config\daemon.json
on Windows Server. For more about configuring Docker using daemon.json
, see
daemon.json.
The following example sets the log driver to gelf
and sets the gelf-address
option.
{
"log-driver": "gelf",
"log-opts": {
"gelf-address": "udp://1.2.3.4:12201"
}
}
Restart Docker for the changes to take effect.
To use gelf
as the default logging driver for new containers, pass the --log-driver
and --log-opt
options to the Docker daemon:
dockerd
-–log-driver gelf –-log-opt gelf-address=udp://1.2.3.4:12201 \
To make the configuration permanent, you can configure it in /etc/docker/daemon.json
:
{
"log-driver": "gelf",
"log-opts": {
"gelf-address": "udp://1.2.3.4:12201"
}
}
You can set the logging driver for a specific container by setting the
--log-driver
flag when using docker create
or docker run
:
$ docker run \
-–log-driver gelf –-log-opt gelf-address=udp://1.2.3.4:12201 \
alpine echo hello world
GELF Options
The gelf
logging driver supports the following options:
Option | Description | Example value |
---|---|---|
gelf-address | The address of the GELF server. udp is the only supported URI specifier and you must specify the port. | --log-opt gelf-address=udp://192.168.0.42:12201 |
gelf-compression-type | The type of compression the GELF driver uses to compress each log message. Allowed values are gzip , zlib and none . The default is gzip . | --log-opt gelf-compression-type=gzip |
gelf-compression-level | The level of compression when gzip or zlib is the gelf-compression-type . An integer in the range of -1 to 9 (BestCompression). Default value is 1 (BestSpeed). Higher levels provide more compression at lower speed. Either -1 or 0 disables compression. | --log-opt gelf-compression-level=2 |
tag | A string that is appended to the APP-NAME in the gelf message. By default, Docker uses the first 12 characters of the container ID to tag log messages. Refer to the log tag option documentation for customizing the log tag format. | --log-opt tag=mailer |
labels | Applies when starting the Docker daemon. A comma-separated list of logging-related labels this daemon will accept. Adds additional key on the extra fields, prefixed by an underscore (_ ). Used for advanced log tag options. | --log-opt labels=production_status,geo |
env | Applies when starting the Docker daemon. A comma-separated list of logging-related environment variables this daemon will accept. Adds additional key on the extra fields, prefixed by an underscore (_ ). Used for advanced log tag options. | --log-opt env=os,customer |
env-regex | Similar to and compatible with env . A regular expression to match logging-related environment variables. Used for advanced log tag options. | --log-opt env-regex=^(os | customer). |
Examples
This example configures the container to use the GELF server running at
192.168.0.42
on port 12201
.
$ docker run -dit \
--log-driver=gelf \
--log-opt gelf-address=udp://192.168.0.42:12201 \
alpine sh