GELF

GELF receivers accept UDP JSON, gzip/zlib, and chunked GELF, or uncompressed NUL-delimited JSON over TLS TCP.

Prerequisites

Create a GELF receiver, configure the sender’s public IPv4 or CIDR, wait for active, and copy its exact hostname and assigned port. GELF does not use an access token.

Docker GELF driver

The Docker GELF driver uses UDP because it cannot use TLS for TCP output.

export FLUXTAIL_GELF_HOST='YOUR_POOL_HOSTNAME'
export FLUXTAIL_GELF_PORT='YOUR_ASSIGNED_PORT'

docker run --rm \
  --log-driver=gelf \
  --log-opt "gelf-address=udp://${FLUXTAIL_GELF_HOST}:${FLUXTAIL_GELF_PORT}" \
  --log-opt gelf-compression-type=gzip \
  alpine sh -c 'echo "hello from Docker GELF"'

TLS TCP test

printf '{"version":"1.1","host":"app-1","short_message":"TLS TCP GELF test"}\0' |
  openssl s_client \
    -quiet \
    -verify_return_error \
    -verify_hostname "$FLUXTAIL_GELF_HOST" \
    -servername "$FLUXTAIL_GELF_HOST" \
    -connect "$FLUXTAIL_GELF_HOST:$FLUXTAIL_GELF_PORT"

Compressed TCP is not supported. Use UDP for the Docker driver and small messages. Use TLS TCP when the sender supports GELF framing and delivery matters more than UDP simplicity.

Verify

Search Live Tail for TLS TCP GELF test or hello from Docker GELF, depending on the test you used. Confirm that the GELF host and custom fields appear as log data.

Troubleshooting

• Confirm the endpoint is active and the sender’s public IPv4 matches a source rule.
• Confirm the destination port and outbound UDP or TCP access.
• For TLS TCP, confirm the receiver hostname is used for both SNI and certificate verification.
• Sender host is log data, not authentication.

Next steps

Use search and filters to inspect GELF fields, then choose TLS TCP for senders that support it when delivery assurance matters. See Graylog’s official GELF specification for message and chunking details.