GELF v1.1 compatibility

[h4cc]

This library does not work when using against a Graylog2 v0.20 server, because the GELF specification has changed.
http://graylog2.org/gelf#specs

These fields are now deprecated: facility, line, file

Also, there seems to be a error when elasticsearch tries to index fields, that do not conform the the spec. For example, if "line" has the string value "null", the message will be dropped.

[lennartkoopmann]

That is not related to GELF but to ElasticSearch. There is a mapping per index that is created dynamically: When a field is seen first, the field keeps the type for that index. That is why you cannot index Strings after you indexed Numbers already.

The deprecated fields are also not at all considered set when processing the message.

[lennartkoopmann]

leaving this ticket open to @bzikarsky though ;)

[bzikarsky]

@lennartkoopmann: Does 0.20 support GELFv1.0 or do we need to add support for 1.1 ASAP?

Regarding the "null"-issue: Is this something library-related? https://github.com/bzikarsky/gelf-php/blob/master/src/Gelf/Message.php#L270 drops any real null-like values. But gelf-php cannot handle errorneous strings.

[h4cc]

@bzikarsky There is a issue for the NULL values in JSON:
Graylog2/graylog2-server#438

[bzikarsky]

But gelf-php does not send any NULLs?

[h4cc]

@bzikarsky This library does not seem to have problem about this.
Bit is still think that using "array_filter($message, 'strlen')" might be problematic, because the specs say some field MUST be there (version, host, short_message). If one of them gets filtered, it might be problematic.

[bzikarsky]

https://github.com/bzikarsky/gelf-php/blob/master/src/Gelf/MessageValidator.php should catch this.

[h4cc]

👍

[bzikarsky]

@lennartkoopmann commented in IRC:
<lennartkoopmann> bzikarsky: 0.20 is supporting all versions, yes

all as in 1.0, 1.1, and the upcoming 1.2

=> We are not on a clock for this. Message validation and serialization/transformationen need a major refactoring in the light of multiple GELF specification versions.

[bzikarsky]

1.2 did not happen - 1.1 got some ammendments.
Basic compatibility got released in 1.0.2 , but it's rather hacky.

I will close this issue, and add a refactoring issue to 2.0.