Grafana Alloy is the new name for our distribution of the OTel collector. Grafana Agent has been deprecated and is in Long-Term Support (LTS) through October 31, 2025. Grafana Agent will reach an End-of-Life (EOL) on November 1, 2025. Read more about why we recommend migrating to Grafana Alloy.

Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

Open source


loki.source.gelf reads Graylog Extended Long Format (GELF) logs from a UDP listener and forwards them to other loki.* components.

Multiple loki.source.gelf components can be specified by giving them different labels and ports.


loki.source.gelf "LABEL" {
  forward_to    = RECEIVER_LIST


The component starts a new UDP listener and fans out log entries to the list of receivers passed in forward_to.

loki.source.gelf supports the following arguments:

listen_addressstringUDP address and port to listen for Graylog messages.
use_incoming_timestampboolWhen false, assigns the current timestamp to the log when it was processedfalseno
relabel_rulesRelabelRulesRelabeling rules to apply on log entries.“{}”no

NOTE: GELF logs can be sent uncompressed or compressed with GZIP or ZLIB. A job label is added with the full name of the component loki.source.gelf.LABEL.

Incoming messages have the following labels available:

  • __gelf_message_level: The GELF level as a string.
  • __gelf_message_host: The host sending the GELF message.
  • __gelf_message_host: The GELF level message version sent by the client.
  • __gelf_message_facility: The GELF facility.

These labels are stripped unless relabeling is used to retain the labels with a loki.relabel component and its Rules export as the relabel_rules argument. An example rule is presented below.

rule {
		action      = "labelmap"
		regex       = "__gelf_(.*)"
		replacement = "gelf_${1}"

Component health

loki.source.gelf is only reported as unhealthy if given an invalid configuration.

Debug Metrics

  • gelf_target_entries_total (counter): Total number of successful entries sent to the GELF target.
  • gelf_target_parsing_errors_total (counter): Total number of parsing errors while receiving GELF messages.


loki.source.gelf "listen"  {
    forward_to = [loki.write.endpoint.receiver]

loki.write "endpoint" {
    endpoint {
        url ="loki:3100/api/v1/push"