Gelf TCP Null frame delimiter option should not be shown in configuration

[pdepaepe]

Hello,

One of the Input Gelf TCP option is:

Null frame delimiter? (optional)
Use null byte as frame delimiter? Otherwise newline delimiter is used.

This option is very interesting as rsyslog doesn't support NUL characters in templates.

After few unsuccessful tries, it appears that this flag is in fact hardcoded:

https://github.com/Graylog2/graylog2-server/blob/a5cec6ee646044d55789cd516569fb7a56a478fd/graylog2-inputs/src/main/java/org/graylog2/inputs/gelf/tcp/GELFTCPInput.java

So if they are no choice, why suggest one? And why \n is not supported?

Thanks.

[kroepke]

There's a (bad) technical reason why that option is exposed.
GELF can contain newlines in fields, that's why it is not possible to use it as a delimiter in TCP, as TCP requires some framing to be able to tell where each message ends. Other transports can use other delimiters.

But you are correct in that the option should not be listed for this type of input.

[pdepaepe]

Ok you can have newlines in fields, but you have a json encapsulation, no ? so your delimiter is not \n but something like }\n

Or even better offer "}" as "natural" json delimiter.

[kroepke]

That only works when you actually parse the content as you receive it, something we do not do right now.

Changing this now is extremely unlikely mostly because I do not believe in just adding a multitude of options to a protocol without proper design and review phases.

For proper GELF TCP support rsyslog will need to be updated. As an alternative I would suggest using structured syslog with TCP in rsyslog, it should solve the same purpose and is easier to implement.

But this is something that we will certainly want to consider for GELF 2.0.

[kroepke]

Oops, wrong button, did not mean to close it.
The presence of the invalid option is still a valid bug report, which we will need to address.

[kkamkou]

Hi guys! When are you planning to release GELF 2.0?

[joschi]

@kkamkou There is no schedule for the release of the next GELF specification.

Additionally, please don't hijack arbitrary issues. Thanks.