Log4r vs Logstash

[bendodd]

We're using Log4r with Logstash via Gelf. Is there a reason that "we" couldn't support tags? http://logstash.net/docs/1.2.2/inputs/gelf#tags

[wr0ngway]

Depending on how logstash parses it, you may be able to do so right now via log4r's MDC by setting the prefix to and empty string ( https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L90 )

- type: GelfOutputter
  name: gelf
  mapped_context_prefix: ''

then in your code

Log4r::MDC.put("tags", ["t1", "t2"])

which would result in a "_tags" key in the gelf message. You may need a logstash filter to strip the underscore.

I tend not to use tags but instead just use MDC with real keys/values since the graylog webui hotlinks custom gelf fields (preceeding underscore).

If this doesn't work, or you'd like something thats less of a hack, feel free to submit a PR.

[wr0ngway]

Although, now that I look at the logstash doc you linked to, I think that tags fields in the logstash config is globally applied to all events received from gelf. Not sure if having a tags field in the event will override its values.

[bendodd]

That is what I tried, but it doesn't work for a few reasons. MDC key/pairs are a subset of @fields, for example @fields._pp, due to the underscore which can't be removed. They are also subject to .inspect which would render them in quotes.

Could tags just be added and merged here https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L25 and https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L48 (allowing tags to be added to all or individual events)?