Documentation Grafana Cloud Instrument and send data Grafana Alloy Reference Components loki loki.source.gelf

loki.source.gelf

loki.source.gelf reads Graylog Extended Long Format (GELF) logs from a UDP listener and forwards them to other loki.* components.

You can specify multiple loki.source.gelf components by giving them different labels and ports.

Usage

Alloy Copy

loki.source.gelf "<LABEL>" {
  forward_to    = <RECEIVER_LIST>
}

Arguments

The component starts a new UDP listener and fans out log entries to the list of receivers passed in forward_to.

You can use the following arguments with loki.source.gelf:

The relabel_rules argument can make use of the rules export from a loki.relabel component to apply one or more relabeling rules to log entries before they’re forwarded to the list of receivers specified in forward_to.

Incoming messages have the following internal labels available:

• __gelf_message_facility: The GELF facility.
• __gelf_message_version: The GELF message version sent by the client.
• __gelf_message_host: The host sending the GELF message.
• __gelf_message_level: The GELF level as a string.

All labels starting with __ are removed prior to forwarding log entries. To keep these labels, relabel them using a loki.relabel component and pass its rules export to the relabel_rules argument.

Blocks

The loki.source.gelf component doesn’t support any blocks. You can configure this component with arguments.

Component health

loki.source.gelf is only reported as unhealthy if given an invalid configuration.

Debug Metrics

• gelf_target_entries_total (counter): Total number of successful entries sent to the GELF target.
• gelf_target_parsing_errors_total (counter): Total number of parsing errors while receiving GELF messages.

Example

Alloy Copy

loki.relabel "gelf" {
  rule {
    source_labels = ["__gelf_message_host"]
    target_label  = "host"
  }
}

loki.source.gelf "listen"  {
  forward_to    = [loki.write.endpoint.receiver]
  relabel_rules = loki.relabel.gelf.rules
}

loki.write "endpoint" {
  endpoint {
    url ="loki:3100/api/v1/push"
  }
}

Compatible components

loki.source.gelf can accept arguments from the following components:

• Components that export Loki LogsReceiver