Grafana Alloy is the new name for our distribution of the OTel collector. Grafana Agent has been deprecated and is in Long-Term Support (LTS) through October 31, 2025. Grafana Agent will reach an End-of-Life (EOL) on November 1, 2025. Read more about why we recommend migrating to Grafana Alloy.

This is documentation for the next version of Agent. For the latest stable release, go to the latest version.

Open source


loki.source.gelf reads Graylog Extended Long Format (GELF) logs from a UDP listener and forwards them to other loki.* components.

Multiple loki.source.gelf components can be specified by giving them different labels and ports.


loki.source.gelf "LABEL" {
  forward_to    = RECEIVER_LIST


The component starts a new UDP listener and fans out log entries to the list of receivers passed in forward_to.

loki.source.gelf supports the following arguments:

listen_addressstringUDP address and port to listen for Graylog messages.
use_incoming_timestampboolWhen false, assigns the current timestamp to the log when it was processedfalseno
relabel_rulesRelabelRulesRelabeling rules to apply on log entries.“{}”no

NOTE: GELF logs can be sent uncompressed or compressed with GZIP or ZLIB. A job label is added with the full name of the component loki.source.gelf.LABEL.

The relabel_rules argument can make use of the rules export from a loki.relabel component to apply one or more relabling rules to log entries before they’re forward to the list of receivers specified in forward_to.

Incoming messages have the following internal labels available:

  • __gelf_message_level: The GELF level as a string.
  • __gelf_message_host: The host sending the GELF message.
  • __gelf_message_host: The GELF level message version sent by the client.
  • __gelf_message_facility: The GELF facility.

All labels starting with __ are removed prior to forwarding log entries. To keep these labels, relabel them using a loki.relabel component and pass its rules export to the relabel_rules argument.

Component health

loki.source.gelf is only reported as unhealthy if given an invalid configuration.

Debug Metrics

  • gelf_target_entries_total (counter): Total number of successful entries sent to the GELF target.
  • gelf_target_parsing_errors_total (counter): Total number of parsing errors while receiving GELF messages.


loki.relabel "gelf" {
  rule {
    source_labels = ["__gelf_message_host"]
    target_label  = "host"

loki.source.gelf "listen"  {
  forward_to    = [loki.write.endpoint.receiver]
  relabel_rules = loki.relabel.gelf.rules

loki.write "endpoint" {
  endpoint {
    url ="loki:3100/api/v1/push"

Compatible components

loki.source.gelf can accept arguments from the following components:


Connecting some components may not be sensible or components may require further configuration to make the connection work correctly. Refer to the linked documentation for more details.