Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was just reading the GELF spec as I'm integrating it into our system. I was just wondering if an additional/custom field can contain a JSON object as the spec doesn't mention it:

So my GELF output (in particular the _request field below) would look something like:

{
  "version": "1.0",
  "host": "www1",
  "short_message": "Short message",
  "full_message": "Backtrace here\n\nmore stuff",
  "timestamp": 1291899928,
  "level": 1,
  "facility": "payment-backend",
  "file": "/var/www/somefile.rb",
  "line": 356,
  "_request": {
      "ip": "123.123.123.123",
      "url": "example.com/dir/file.ext",
      "method": "get",
      "referer" "example.net"
}
share|improve this question

2 Answers 2

I think it is better to avoid such nested structures, it will just complicate things. You can flatten it out and put this into the JSON instead:

_request_ip
_request_url
_request_method
_request_referer
share|improve this answer
    
I had considered this however for complex stack traces it would make sense to include it as a JSON object and would make it much simpler to read. So I was wondering if the GELF standard allows for this? I'm not a Graylog2 user so I'm not sure if it even supports it but I did want to make my application compatible. –  Sean Bannister Feb 25 '12 at 5:43
    
Hey Sean, please post this as a suggestion on the Graylog2 mailing list, so we can discuss this! –  Lennart Mar 9 '12 at 14:45
    
@Lennart Cheers, posted it at groups.google.com/forum/#!topic/graylog2/Xg3v3Qh8fmo –  Sean Bannister Mar 10 '12 at 12:42
up vote 1 down vote accepted

Currently GELF doesn't support nested JSON objects however if anyones interested please comment at groups.google.com/forum/#!topic/graylog2/Xg3v3Qh8fmo

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.