Search code examples
dockerloggingnloggrayloggelf

How to forward logs from docker container to Graylog server without pre-formatting?

I have a Docker container that sends its logs to Graylog via udp. Previously I just used it to output raw messages, but now I've come up with a solution that logs in GELF format. However, Docker just puts it into "message" field (screen from Graylog Web Interface): enter image description here

Or in plain text:

{
   "version":"1.1",
   "host":"1eefd38079fa",
   "short_message":"Content root path: /app",
   "full_message":"Content root path: /app",
   "timestamp":1633754884.93817,
   "level":6,
   "_contentRoot":"/app",
   "_LoggerName":"Microsoft.Hosting.Lifetime",
   "_threadid":"1",
   "_date":"09-10-2021 04:48:04,938",
   "_level":"INFO",
   "_callsite":"Microsoft.Extensions.Hosting.Internal.ConsoleLifetime.OnApplicationStarted"
}

GELF-driver is configured in docker-compose file:

logging:
  driver: "gelf"
  options:
    gelf-address: "udp://sample-ip:port"

How to make Docker just forward these already formatted logs? Is there any way to process these logs and append them as custom fields to docker logs? The perfect solution would be to somehow enable gelf log driver, but disable pre-processing / formatting since logs are already GELF.

PS. For logs I'm using NLog library, C# .NET 5 and its NuGet package https://github.com/farzadpanahi/NLog.GelfLayout

Solution

  • In my case, there was no need to use NLog at all. It was just a logging framework which no one attempted to dive into.

    So a better alternative is to use GELF logger provider for Microsoft.Extensions.Logging: Gelf.Extensions.Logging - https://github.com/mattwcole/gelf-extensions-logging Don't forget to disable GELF for docker container if it is enabled.

    It supports additional fields, parameterization of the formatted string (parameters in curly braces {} become the graylog fields) and is easily configured via appsettings.json

    Some might consider this not be an answer since I was using NLog, but for me -- this is a neat way to send customized logs without much trouble. As for NLog, I could not come up with a solution.