---
description: Describes how to use the Graylog Extended Format logging driver.
keywords: graylog, gelf, logging, driver
redirect_from:
- /engine/reference/logging/gelf/
title: Graylog Extended Format logging driver
---

The `gelf` logging driver is a convenient format that is understood by a number of tools such as
[Graylog](https://www.graylog.org/), [Logstash](https://www.elastic.co/products/logstash), and
[Fluentd](http://www.fluentd.org/). Many tools use this format.

In GELF, every log message is a dict with the following fields:

- version
- host (who sent the message in the first place)
- timestamp
- short and long version of the message
- any custom fields you configure yourself

## Usage

To use the `gelf` driver as the default logging driver, set the `log-driver` and
`log-opt` keys to appropriate values in the `daemon.json` file, which is located
in `/etc/docker/` on Linux hosts or `C:\ProgramData\docker\config\daemon.json`
on Windows Server. For more about configuring Docker using `daemon.json`, see
[daemon.json](/engine/reference/commandline/dockerd.md#daemon-configuration-file).

The following example sets the log driver to `gelf` and sets the `gelf-address`
option.

```json
{
  "log-driver": "gelf",
  "log-opts": {
    "gelf-address": "udp://1.2.3.4:12201"
  }
}
```

Restart Docker for the changes to take effect.

To use `gelf` as the default logging driver for new containers, pass the `--log-driver`
and `--log-opt` options to the Docker daemon:

```bash
dockerd
  -–log-driver gelf –-log-opt gelf-address=udp://1.2.3.4:12201 \
```

To make the configuration permanent, you can configure it in `/etc/docker/daemon.json`:

```json
{
  "log-driver": "gelf",
  "log-opts":  {
    "gelf-address": "udp://1.2.3.4:12201"
  }
}
```

You can set the logging driver for a specific container by setting the
`--log-driver` flag when using `docker create` or `docker run`:

```bash
$ docker run \
      -–log-driver gelf –-log-opt gelf-address=udp://1.2.3.4:12201 \
      alpine echo hello world
```

### GELF options

The `gelf` logging driver supports the following options:

| Option                     | Description                                                                                                                                                                                                                                                              | Example value                                       |
| :------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------        | :-------------------------------------------------- |
| `gelf-address`             | The address of the GELF server. `udp` is the only supported URI specifier and you must specify the port.                                                                                                                                                                 | `--log-opt gelf-address=udp://192.168.0.42:12201`   |
| `gelf-compression-type`    | The type of compression the GELF driver uses to compress each log message. Allowed values are `gzip`, `zlib` and `none`. The default is `gzip`.                                                                                                                          | `--log-opt gelf-compression-type=gzip`              |
| `gelf-compression-level`   | The level of compression when `gzip` or `zlib` is the `gelf-compression-type`. An integer in the range of `-1` to `9` (BestCompression). Default value is 1 (BestSpeed). Higher levels provide more compression at lower speed. Either `-1` or `0` disables compression. | `--log-opt gelf-compression-level=2`                |
| `tag`                      | A string that is appended to the `APP-NAME` in the `gelf` message. By default, Docker uses the first 12 characters of the container ID to tag log messages. Refer to the [log tag option documentation](log_tags.md) for customizing the log tag format.                 | `--log-opt tag=mailer`                              |
| `labels`                   | Applies when starting the Docker daemon. A comma-separated list of logging-related labels this daemon will accept. Adds additional key on the `extra` fields, prefixed by an underscore (`_`). Used for advanced [log tag options](log_tags.md).                         | `--log-opt labels=production_status,geo`            |
| `env`                      | Applies when starting the Docker daemon. A comma-separated list of logging-related environment variables this daemon will accept. Adds additional key on the `extra` fields, prefixed by an underscore (`_`). Used for advanced [log tag options](log_tags.md).          | `--log-opt env=os,customer`                         |
| `env-regex`                | Similar to and compatible with `env`. A regular expression to match logging-related environment variables. Used for advanced [log tag options](log_tags.md).                                                                                                             | `--log-opt env-regex=^(os                           | customer).` |

### Examples

This example configures the container to use the GELF server running at
`192.168.0.42` on port `12201`.

```bash
$ docker run -dit \
             --log-driver=gelf \
             --log-opt gelf-address=udp://192.168.0.42:12201 \
             alpine sh
```


