Native GELF Windows Executable

[neilriach]

Wondering if there is a native GELF executable for Windows that could be run on Windows server seperate to the SEQ Windows server which would forward GELF logs to SEQ a little like the Docker container does for Linux. I did find sgelf.exe in the Nuget package in the win-x64 folder and got it to run by setting the env variables as mentioned in the Docker version and it did echo the GELF logs sent to it but didn't appear to forward to the SEQ server.

I realise this is a little off the 'beating track' for SEQ but I thought I would ask anyway.

Many thanks in advance for any details even if it is a no!

Thank you.
Neil

[nblumhardt]

Hi Neil,

Yes, this is possible; in the Dockerfile for Seq.Input.Gelf, you'll find the run.sh script pipes the output from sqelf.exe through seqcli ingest ..., which is also available either as a standalone binary (https://github.com/datalust/seqcli/releases) or with the Seq installer for Windows:

https://github.com/datalust/seq-input-gelf/blob/dev/dockerfiles/run.sh#L10

Let me know if this achieves what you're looking for.

Best regards,
Nick

[neilriach]

Hi Nick,

your suggestion worked perfectly. It even worked in a Windows Docker container and now all my Docker container logs are available in SEQ.

Many thanks for your timely response.

Regards
Neil

[mloskot]

@neilriach Could you share some details, perhaps Docker Compose config, how you orchestrated the logs collection with the GELF for Windows containers?

[neilriach]

@mloskot I simply created a Windows Nano server docker container with both sqelf.exe and seqcli files with a batch script Docker entrypoint of c:\gelf\sqelf.exe | c:\gelf\seqcli.exe ingest --invalid-data=ignore --send-failure=continue --json -s http://:5341 Al that is then required is to configure your Docker containers with a GELF logging driver.

I am by no means an expert on this and there may be much better ways of achieving this but with Nicks help above it worked first time.

I am only using it in a test environment, I can send you the Docker build file if it would help.

@nblumhardt All the logs from certain Docker containers end up classified as ERROR even though the message does have level=info in it. Is there anything I can do to overcome this?

Regards
Neil

[KodrAus]

@neilriach I think this might happen when containers log to stderr and that output is forwarded via the Docker log driver to GELF, which assigns it a severity of 3, indicating an error. To get the GELF container to use a different log level, you'll need to write your output as newline delimited JSON using CLEF property names.

[mloskot]

@neilriach Thanks for the explanation that will do.