GELF ("Graylog Extended Log Format") is a structured log event format that's implemented for logging libraries in many programming languages. Seq can receive GELF events via UDP, and supports common features such as compression and chunking.
GELF is not enabled out-of-the-box, and must be enabled one of two ways:
- On Windows, the Seq.Input.Gelf app must be installed and configured
- On Docker, the
datalust/sqelfcontainer must be deployed alongside Seq
On Windows, the GELF input is installed into Seq as a Seq App.
1. Install the app package
In Settings > Apps, choose Install from NuGet. The app package id is Seq.Input.Gelf.
2. Start an instance of the app
From the apps screen, choose Add Instance and give the new GELF input a name.
The default settings will cause the GELF input to listen on localhost port 12201. Choose a different port if required.
Select Save Changes to start the input.
3. Configure Windows Firewall
Ensure UDP port 12201 (or the selected port, if you specified a different one), is allowed through Windows Firewall.
4. Log some events!
That's all there is to it. Events ingested through the input will appear in the Events stream. If the input doesn't work, check for diagnostic events raised by the input app (there is some status information shown under the app instance name).
Events ingested by the input will be associated with the default None API key, which can be used to attach properties, apply filters, or set a minimum level for the ingested events.
For Docker, the app is deployed as a Docker container that is expected to run alongside the Seq container. The
datalust/sqelf image accepts UDP GELF payloads on port 12201, and forwards them over HTTP to the Seq ingestion endpoint specified in the
SEQ_ADDRESS environment variable.
To run the container:
$ docker run \ --rm \ -it \ -p 12201:12201/udp \ -e SEQ_ADDRESS=https://seq.example.com \ datalust/sqelf
sqelf container can be configured using the following environment variables:
||The address of the Seq server to forward events to||
||The API key to use||-|
||The address to bind the UDP GELF server to||
The following is an example
docker-compose file that can be used to manage a local Seq container alongside
sqelf in your development environment to collect log events from other containers:
version'3' services sqelf imagedatalust/sqelf latest depends_on seq ports "12201:12201/udp" environment SEQ_ADDRESS"http://seq:5341" restartunless-stopped seq imagedatalust/seq latest ports "5341:80" environment ACCEPT_EULAY restartunless-stopped volumes ./seq-data:/data
The service can be started using
$ docker-compose -p seq up -d
To collect logs from Docker's logging infrastructure, see Collecting Docker container logs.