Hi! I would greatly recommend using GELF over TCP for this. Chunking is only necessary for larger messages when using UDP because of the packet size limitations inherent with UDP.
IMHO UDP really is only useful for short messages that get sent inline of some application, where you want less chance of a network call blocking, for all other purposes I wouldn’t recommend it. Chunked GELF also doesn’t play nice with load balancers, many software ones can’t deal with UDP anyway, and chunking is a hassle in general. Especially for netcat I don’t think there’s any upside to UDP. If you only want to read a file also check out the Graylog Collector: http://docs.graylog.org/en/1.2/pages/collector.html <http://docs.graylog.org/en/1.2/pages/collector.html> It might just should solve your problem already. Please note that the version in GELF is not the Graylog version, but the version of the GELF format itself: it should always be 1.1 at the moment. cheers, -kay > On 17 Sep 2015, at 16:14, Jeffrey Newell <[email protected]> wrote: > > I am just getting started using graylog, and am honing my logging. > I have a large dump from an external tool im using in my data pipeline that I > want so send as a Debug-level single log item. > I'm interfacing with graylog with nc, piping a formatted string, of GELF > format, to it (ip address obfuscated below, of course): > echo "{\"version\": > \"$GRAYLOG_VERSION\",\"host\":\"$APP_HOST\",\"short_message\":\"$SHORT_MESSAGE\",\"full_message\":\"$j\",\"level\":$LOG_LEVEL,\"log_type\":\"$LOG_TYPE\"}" > | nc -w 3 -u 00.00.00.00 12201 > > > > I see in the docs there is a direction, and further info about a structure to > prepend, but I'm not clear WHERE this should go, like directly before the { > or what, any separators? An example would be really helpful: > > You can define chunks of messages by prepending a byte header to a GELF > message including a message ID and sequence count/number to reassemble the > message later > > > > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/9e6a983b-089b-4e31-abd3-13a77add9d52%40googlegroups.com > > <https://groups.google.com/d/msgid/graylog2/9e6a983b-089b-4e31-abd3-13a77add9d52%40googlegroups.com?utm_medium=email&utm_source=footer>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/B2B358B1-27D5-4995-B93B-3D054B189451%40gmail.com. For more options, visit https://groups.google.com/d/optout.
