Graylog Extended Log Format DecoderΒΆ

New in version 0.8.

Plugin Name: SandboxDecoder
File Name: lua_decoders/graylog_extended.lua

Parses a payload containing JSON in the Graylog2 Extended Format specficiation.


  • type (string, optional, default nil):

    Sets the message ‘Type’ header to the specified value

  • payload_keep (bool, optional, default false)

    Always preserve the original log line in the message payload.

Example of Graylog2 Exteded Format Log

  "version": "1.1",
  "host": "",
  "short_message": "This is a short message to identify what is going on.",
  "full_message": "An entire backtrace\ncould\ngo\nhere",
  "timestamp": 1385053862.3072,
  "level": 1,
  "_user_id": 9001,
  "_some_info": "foo",
  "_some_env_var": "bar"

Example Heka Configuration

type = "LogstreamerInput"
log_directory = "/var/log"
file_match = 'application\.gelf'
decoder = "GraylogDecoder"

type = "SandboxDecoder"
filename = "lua_decoders/graylog_decoder.lua"

    type = "gelf"
    payload_keep = true