Graylog Extended Format logging driver

The gelf logging driver is a convenient format that's understood by a number of tools such as Graylog, Logstash, and Fluentd. Many tools use this format.

In GELF, every log message is a dict with the following fields:

• Version
• Host (who sent the message in the first place)
• Timestamp
• Short and long version of the message
• Any custom fields you configure yourself

Usage

To use the gelf driver as the default logging driver, set the log-driver and log-opt keys to appropriate values in the daemon.json file. For more about configuring Docker using daemon.json, see daemon.json.

Note

If you're using Docker Desktop, edit the daemon configuration through the Docker Desktop Dashboard. Open Settings and select Docker Engine. For details, see Docker Engine settings.

The following example sets the log driver to gelf and sets the gelf-address option.

{
  "log-driver": "gelf",
  "log-opts": {
    "gelf-address": "udp://1.2.3.4:12201"
  }
}

Restart Docker for the changes to take effect.

Note

log-opts configuration options in the daemon.json configuration file must be provided as strings. Boolean and numeric values (such as the value for gelf-tcp-max-reconnect) must therefore be enclosed in quotes (").

You can set the logging driver for a specific container by setting the --log-driver flag when using docker container create or docker run:

$ docker run \
      --log-driver gelf --log-opt gelf-address=udp://1.2.3.4:12201 \
      alpine echo hello world

GELF options

The gelf logging driver supports the following options:

Note

The gelf driver doesn't support TLS for TCP connections. Messages sent to TLS-protected inputs can silently fail.

Examples

This example configures the container to use the GELF server running at 192.168.0.42 on port 12201.

$ docker run -dit \
    --log-driver=gelf \
    --log-opt gelf-address=udp://192.168.0.42:12201 \
    alpine sh