Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

DocumentationGrafana AgentGrafana Agent FlowReferenceComponentsloki.source.gelf

loki.source.gelf

loki.source.gelf reads Graylog Extended Long Format (GELF) logs from a UDP listener and forwards them to other loki.* components.

Multiple loki.source.gelf components can be specified by giving them different labels and ports.

Usage

river Copy

loki.source.gelf "LABEL" {
  forward_to    = RECEIVER_LIST
}

Arguments

The component starts a new UDP listener and fans out log entries to the list of receivers passed in forward_to.

loki.source.gelf supports the following arguments:

NOTE: GELF logs can be sent uncompressed or compressed with GZIP or ZLIB. A job label is added with the full name of the component loki.source.gelf.LABEL.

Incoming messages have the following labels available:

• __gelf_message_level: The GELF level as a string.
• __gelf_message_host: The host sending the GELF message.
• __gelf_message_host: The GELF level message version sent by the client.
• __gelf_message_facility: The GELF facility.

These labels are stripped unless relabeling is used to retain the labels with a loki.relabel component and its Rules export as the relabel_rules argument. An example rule is presented below.

river Copy

rule {
		action      = "labelmap"
		regex       = "__gelf_(.*)"
		replacement = "gelf_${1}"
	}

Component health

loki.source.gelf is only reported as unhealthy if given an invalid configuration.

Debug Metrics

• gelf_target_entries_total (counter): Total number of successful entries sent to the GELF target.
• gelf_target_parsing_errors_total (counter): Total number of parsing errors while receiving GELF messages.

Example

river Copy

loki.source.gelf "listen"  {
    forward_to = [loki.write.endpoint.receiver]
}

loki.write "endpoint" {
    endpoint {
        url ="loki:3100/api/v1/push"
    }  
}