From ffe0b7e184af24562cdf870e4aeb5a60a03d1e69 Mon Sep 17 00:00:00 2001 From: Joshua Powers Date: Mon, 28 Feb 2022 09:20:08 -0700 Subject: [PATCH] docs: add info on Graylog GELF spec (#10745) Fixes: #10724 --- plugins/outputs/graylog/README.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/plugins/outputs/graylog/README.md b/plugins/outputs/graylog/README.md index d59602148..2b0475263 100644 --- a/plugins/outputs/graylog/README.md +++ b/plugins/outputs/graylog/README.md @@ -4,6 +4,23 @@ This plugin writes to a Graylog instance using the "[GELF][]" format. [GELF]: https://docs.graylog.org/en/3.1/pages/gelf.html#gelf-payload-specification +## GELF Fields + +The [GELF spec][] spec defines a number of specific fields in a GELF payload. +These fields may have specific requirements set by the spec and users of the +Graylog plugin need to follow these requirements or metrics may be rejected +due to invalid data. + +For example, the timestamp field defined in the GELF spec, is required to be +a UNIX timestamp. This output plugin will not modify or check the timestamp +field if one is present and send it as-is to Graylog. If the field is absent +then Telegraf will set the timestamp to the current time. + +Any field not defined by the spec will have an underscore (e.g. `_`) prefixed +to the field name. + +[GELF spec]: https://docs.graylog.org/docs/gelf#gelf-payload-specification + ## Configuration ```toml