GELF
The Graylog Extended Log Format is the native log format of Graylog. A GELF record is a JSON document with a small set of reserved fields and any number of custom fields, each prefixed with an underscore.
DataStream converts to and from GELF with the Normalize processor. Normalization emits GELF 1.1, written into the version field of every record.
Core Fields
These nine names are reserved and are written without an underscore prefix.
| Field | Source | Description |
|---|---|---|
version | - | Always 1.1 |
host | First available of host.hostname, observer.hostname, device.host, log.syslog.hostname | Falls back to unknown |
short_message | message | Falls back to the event action or category, then to Log event. Truncated to 200 characters |
full_message | First available of event.original, the syslog structured data, message | Omitted when no source is available |
timestamp | @timestamp | Unix seconds with a fractional part. Falls back to the time of conversion |
level | event.severity | Syslog severity, 0-7. See below |
facility | The syslog facility name, observer.facility, or event.category | Omitted when no source is available |
line | - | Reserved by the format. Never written by DataStream |
file | - | Reserved by the format. Never written by DataStream |
version, host and short_message are supplied by the schema enforcement pass, which is skipped when the processor is run with ignore_rules set. Without it, a record carries the mapped fields but none of these three.
Custom Fields
Every other field is written as a custom field. The ECS name is prefixed with an underscore and its dots become underscores:
| ECS Field | GELF Field |
|---|---|
source.ip | _source_ip |
destination.port | _destination_port |
source.geo.country | _source_geo_country |
observer.vendor | _observer_vendor |
The rule is mechanical and applies to every field, so no separate mapping table is needed. The only exceptions are the nine reserved names above, which are written unprefixed.
Severity Levels
level uses the syslog severity scale. The source value is matched case-insensitively against the names below; a value that is already a number in the range 0-7 is used as-is.
| Level | Name | Recognized Values |
|---|---|---|
0 | Emergency | emergency, emerg, panic |
1 | Alert | alert |
2 | Critical | critical, crit, fatal |
3 | Error | error, err, failure, fail, high |
4 | Warning | warning, warn, medium |
5 | Notice | notice, low |
6 | Informational | informational, info, information |
7 | Debug | debug, trace, verbose |
An unrecognized value produces 6. When the source carries a severity name, it is preserved in _original_severity.
Facility
facility uses the standard syslog facility numbers, 0 for kern through 23 for local7. A name that is not recognized produces 1, the user facility. When no source field is present, facility is omitted rather than defaulted.
Format Detection
When source_format is not set, a record is treated as GELF if it carries version, host and short_message together.
Example
A Fortigate traffic event converted to GELF:
{
"version": "1.1",
"host": "datastream",
"short_message": "traffic:forward close",
"timestamp": 1726671509,
"level": 6,
"_source_ip": "10.1.100.11",
"_source_port": 54190,
"_destination_ip": "52.53.140.235",
"_destination_port": 443,
"_network_protocol": "TCP",
"_event_outcome": "Success",
"_observer_vendor": "Fortinet",
"_observer_product": "Fortigate"
}
Delivery
Normalization produces the JSON document only. Splitting a large record across UDP datagrams is handled by the Graylog target when the message exceeds its configured size, and applies to GELF over UDP alone. Payload compression is not implemented.