GelfLayout-package contains custom layout renderer for NLog to format log messages as GELF Json structures for GrayLog-server.
PM> Install-Package NLog.GelfLayout
- IncludeEventProperties - Include all properties from the LogEvent. Boolean. Default = true
- IncludeScopeProperties - Include all properties from NLog MDLC / MEL BeginScope. Boolean. Default = false
- ExcludeProperties - Comma separated string with LogEvent property names to exclude.
- IncludeLegacyFields - Include deprecated fields no longer part of official GelfVersion 1.1 specification. Boolean. Default = false
- Facility - Legacy Graylog Message Facility-field, when specifed it will fallback to legacy GelfVersion 1.0. Ignored when IncludeLegacyFields=False
- HostName - Override Graylog Message Host-field. Default:
${hostname} - FullMessage - Override Graylog Full-Message-field. Default:
${message} - ShortMessage - Override Graylog Short-Message-field. Default:
${message}
You can configure this layout for NLog Targets that respect Layout attribute. For instance the following configuration writes log messages to a RabbitMQ-adolya Exchange in GELF format.
<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http:https://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http:https://www.w3.org/2001/XMLSchema-instance" >
<extensions>
<add assembly="NLog.Targets.RabbitMQ" />
<add assembly="NLog.Layouts.GelfLayout" />
</extensions>
<targets async="true">
<target name="RabbitMQTarget"
xsi:type="RabbitMQ"
hostname="mygraylog.mycompany.com"
exchange="logmessages-gelf"
durable="true"
useJSON="false"
layout="${gelf}"
/>
</targets>
<rules>
<logger name="*" minlevel="Debug" writeTo="RabbitMQTarget" />
</rules>
</nlog>In this example there would be a [Graylog2] server that consumes the queued GELF messages.
<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http:https://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http:https://www.w3.org/2001/XMLSchema-instance" >
<extensions>
<add assembly="NLog.Layouts.GelfLayout" />
</extensions>
<targets async="true">
<target xsi:type="Network" name="GelfHttp" address="http:https://localhost:12201/gelf" layout="${gelf}" />
</targets>
<rules>
<logger name="*" minlevel="Debug" writeTo="GelfHttp" />
</rules>
</nlog><?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http:https://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http:https://www.w3.org/2001/XMLSchema-instance" >
<extensions>
<add assembly="NLog.Layouts.GelfLayout" />
</extensions>
<targets async="true">
<target xsi:type="Network" name="GelfTcp" address="tcp:https://graylog:12200" layout="${gelf}" newLine="true" lineEnding="Null" />
</targets>
<rules>
<logger name="*" minlevel="Debug" writeTo="GelfTcp" />
</rules>
</nlog>Notice the options Compress="GZip" and compressMinBytes="1024" requires NLog v5.0
<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http:https://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http:https://www.w3.org/2001/XMLSchema-instance" >
<extensions>
<add assembly="NLog.Layouts.GelfLayout" />
</extensions>
<targets async="true">
<target xsi:type="Network" name="GelfUdp" address="udp:https://graylog:12201" layout="${gelf}" compress="GZip" compressMinBytes="1000" />
</targets>
<rules>
<logger name="*" minlevel="Debug" writeTo="GelfUdp" />
</rules>
</nlog>Notice when message exceeds the default MTU-size (usually 1500 bytes), then the IP-network-layer will attempt to perform IP-fragmentation and handle messages up to 65000 bytes. But IP fragmentation will fail if the network switch/router has been configured to have DontFragment enabled, where it will drop the network packets. Usually one will only use UDP on the local network, since no authentication or security, and network switches on the local-network seldom has DontFragment enabled (or under your control to be configured).
<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http:https://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http:https://www.w3.org/2001/XMLSchema-instance" >
<extensions>
<add assembly="NLog.Layouts.GelfLayout" />
</extensions>
<targets async="true">
<target xsi:type="Network" name="GelfHttp" address="http:https://localhost:12201/gelf">
<layout type="GelfLayout">
<field name="threadid" layout="${threadid}" />
</layout>
</target>
</targets>
<rules>
<logger name="*" minlevel="Debug" writeTo="GelfHttp" />
</rules>
</nlog>GELF converter module is all taken from Gelf4NLog by Ozan Seymen