# Logging + Graylog

**URL:** https://forums.suse.com/t/logging-graylog/10995
**Category:** SUSE Rancher Prime
**Created:** [July 3, 2018, 7:19pm UTC](https://forums.suse.com/t/logging-graylog/10995 "2018-07-03T19:19:02Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Gui](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/gui/32/4173_2.png) [@Gui](https://forums.suse.com/u/Gui)
#### Post date: [July 3, 2018, 7:19pm UTC](https://forums.suse.com/t/logging-graylog/10995/1 "2018-07-03T19:19:03Z")

</div>

Hello everyone,

We use Graylog with logging tool. In my Rancher cluster, I set up for sending all logs for Graylog. I’m using Rsyslog protocol.

But I have some questions about it. When I configure my logging inside Rancher to use Rsyslog the message example doesn’t show “log message” (Error, actually state).

Timestamp = July 3rd 2018, 3:32:54  
Host = 192.168.1.2  
Program =  
Message =  
stream:stderr  
docker:  
{  
“container\_id”=\>“218477a1e…0371”  
}  
kubernetes:  
{  
“container\_name”=\>“kube-flannel”,  
“namespace\_name”=\>“kube-system”,  
“pod\_name”=\>“kube-flannel-8ztd8”  
}

That’s ok, It works. I have received messages about namespace, environment, host and other information but not the main information “logs messages”.

Is possible pick up the log message through Rsyslog?

---

<div class="post-metadata">

### Author: ![dnauck](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/dnauck/32/3875_2.png) [@dnauck](https://forums.suse.com/u/dnauck)
#### Post date: [July 8, 2018, 4:00pm UTC](https://forums.suse.com/t/logging-graylog/10995/2 "2018-07-08T16:00:24Z")

</div>

I added a feature request to support the GELF Graylog format:

> <https://github.com/rancher/rancher/issues/14062>
>
> Please add support for @lennartkoopmann's Graylog (and it's GELF format) https:/…/github.com/graylog2 to the logging settings of clusters and projects.
> 
> gz#12973

Currently i’m just using the syslog connector (but parsing/field extraction is missing then)

---

<div class="post-metadata">

### Author: ![Gui](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/gui/32/4173_2.png) [@Gui](https://forums.suse.com/u/Gui)
#### Post date: [July 9, 2018, 12:29am UTC](https://forums.suse.com/t/logging-graylog/10995/3 "2018-07-09T00:29:49Z")

</div>

Hi @dnauck,

I hope that this feauture to be add soon!! But for the time I have used other way for… I’ve disabled log trought Rancher Admin Interface for all my clusters before I did deployed GELF with a daemonset inside my Kubernetes Cluster. By the way You’ll need deploy this solution for all your clusters. In my environment We have three cluster, so I needed to make three demonset deploy, one for each environment. I configured a port for each one.

Thank you!
