Caution
Grafana Alloy is the new name for our distribution of the OTel collector. Grafana Agent has been deprecated and is in Long-Term Support (LTS) through October 31, 2025. Grafana Agent will reach an End-of-Life (EOL) on November 1, 2025. Read more about why we recommend migrating to Grafana Alloy.
Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.
loki.source.gelf
loki.source.gelf
reads Graylog Extended Long Format (GELF) logs from a UDP listener and forwards them to other
loki.*
components.
Multiple loki.source.gelf
components can be specified by giving them
different labels and ports.
Usage
loki.source.gelf "LABEL" {
forward_to = RECEIVER_LIST
}
Arguments
The component starts a new UDP listener and fans out
log entries to the list of receivers passed in forward_to
.
loki.source.gelf
supports the following arguments:
Name | Type | Description | Default | Required |
---|---|---|---|---|
listen_address | string | UDP address and port to listen for Graylog messages. | 0.0.0.0:12201 | no |
use_incoming_timestamp | bool | When false, assigns the current timestamp to the log when it was processed | false | no |
relabel_rules | RelabelRules | Relabeling rules to apply on log entries. | “{}” | no |
NOTE: GELF logs can be sent uncompressed or compressed with GZIP or ZLIB. A
job
label is added with the full name of the componentloki.source.gelf.LABEL
.
The relabel_rules
argument can make use of the rules
export from a
loki.relabel component to apply one or more relabling rules to log entries
before they’re forward to the list of receivers specified in forward_to
.
Incoming messages have the following internal labels available:
__gelf_message_level
: The GELF level as a string.__gelf_message_host
: The host sending the GELF message.__gelf_message_host
: The GELF level message version sent by the client.__gelf_message_facility
: The GELF facility.
All labels starting with __
are removed prior to forwarding log entries. To
keep these labels, relabel them using a loki.relabel component and pass its
rules
export to the relabel_rules
argument.
Component health
loki.source.gelf
is only reported as unhealthy if given an invalid
configuration.
Debug Metrics
gelf_target_entries_total
(counter): Total number of successful entries sent to the GELF target.gelf_target_parsing_errors_total
(counter): Total number of parsing errors while receiving GELF messages.
Example
loki.relabel "gelf" {
rule {
source_labels = ["__gelf_message_host"]
target_label = "host"
}
}
loki.source.gelf "listen" {
forward_to = [loki.write.endpoint.receiver]
relabel_rules = loki.relabel.gelf.rules
}
loki.write "endpoint" {
endpoint {
url ="loki:3100/api/v1/push"
}
}