Menu
Grafana Agent Grafana Agent Flow Reference Components loki.source.gelf
Open source

loki.source.gelf

loki.source.gelf reads Graylog Extended Long Format (GELF) logs from a UDP listener and forwards them to other loki.* components.

Multiple loki.source.gelf components can be specified by giving them different labels and ports.

Usage

loki.source.gelf "LABEL" {
  forward_to    = RECEIVER_LIST
}

Arguments

The component starts a new UDP listener and fans out log entries to the list of receivers passed in forward_to.

loki.source.gelf supports the following arguments:

NameTypeDescriptionDefaultRequired
listen_addressstringUDP address and port to listen for Graylog messages.0.0.0.0:12201no
use_incoming_timestampboolWhen false, assigns the current timestamp to the log when it was processedfalseno
relabel_rulesRelabelRulesRelabeling rules to apply on log entries.“{}”no

NOTE: GELF logs can be sent uncompressed or compressed with GZIP or ZLIB. A job label is added with the full name of the component loki.source.gelf.LABEL.

Incoming messages have the following labels available:

  • __gelf_message_level: The GELF level as a string.
  • __gelf_message_host: The host sending the GELF message.
  • __gelf_message_host: The GELF level message version sent by the client.
  • __gelf_message_facility: The GELF facility.

These labels are stripped unless relabeling is used to retain the labels with a loki.relabel component and its Rules export as the relabel_rules argument. An example rule is presented below.

rule {
		action      = "labelmap"
		regex       = "__gelf_(.*)"
		replacement = "gelf_${1}"
	}

Component health

loki.source.gelf is only reported as unhealthy if given an invalid configuration.

Debug Metrics

  • gelf_target_entries_total (counter): Total number of successful entries sent to the GELF target.
  • gelf_target_parsing_errors_total (counter): Total number of parsing errors while receiving GELF messages.

Example

loki.source.gelf "listen"  {
    forward_to = [loki.write.endpoint.receiver]
}

loki.write "endpoint" {
    endpoint {
        url ="loki:3100/api/v1/push"
    }  
}