Sending logs to Graylog and in Gelf format

Question

I would like to use graylog as central logging server and currently I am just using slf4j Logger "slf4j-api" as Java logging framework for logging in my java application. Can i use SLF4J to send logging to Graylog? or Which additional libraries do i need to send these logs to Graylog?

Answer 1

SLF4J is just a facade for other logging libraries.

You have to use a GELF appender for the specific logging framework (Log4j, Logback, java.util.logging, etc.) you're using in your application.

Check out the Graylog Marketplace for existing GELF appenders for Java logging frameworks:

https://marketplace.graylog.org/addons?tag=java

Answer 2

As of 2023

Supposing one uses logback, you need to add appended to logback config.

New marketplace link would be
https://community.graylog.org/search?q=java%20%23marketplace
(as no so clearly explained in video )

However for some time top recommended appender is
https://github.com/mp911de/logstash-gelf -> https://logging.paluch.biz/examples/logback.html

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE configuration>
<configuration>
    <contextName>test</contextName>
    <jmxConfigurator/>
    <appender name="gelf" class="biz.paluch.logging.gelf.logback.GelfLogbackAppender">
        <host>udp:localhost</host>
        <port>12201</port>
        <version>1.0</version>
        <facility>logstash-gelf</facility>
        <extractStackTrace>true</extractStackTrace>
        <filterStackTrace>true</filterStackTrace>
        <includeLocation>true</includeLocation>
        <mdcProfiling>true</mdcProfiling>
        <timestampPattern>yyyy-MM-dd HH:mm:ss,SSS</timestampPattern>
        <maximumMessageSize>8192</maximumMessageSize>
        <additionalFields>fieldName1=fieldValue1,fieldName2=fieldValue2</additionalFields>
        <additionalFieldTypes>fieldName1=String,fieldName2=Double,fieldName3=Long</additionalFieldTypes>
        <mdcFields>mdcField1,mdcField2</mdcFields>
        <dynamicMdcFields>myMdc.*,[a-z]+Field</dynamicMdcFields>
        <dynamicMdcFieldTypes>my_field.*=String,business\..*\.field=double</dynamicMdcFieldTypes>
        <includeFullMdc>true</includeFullMdc>
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
    </appender>
    <root level="DEBUG">
        <appender-ref ref="gelf" />
    </root>
</configuration>

Related

• Direct logback logs to graylog