---
title: "graylog2: Send logs to Graylog"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-destinations/configuring-destinations-graylog/"
last_modified: "2026-08-02T11:39:11+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# graylog2: Send logs to Graylog

## graylog2(): Sending logs to Graylog

You can use the `graylog2()` destination and a Graylog Extended Log Format (GELF) template to send syslog messages to [Graylog](http://docs.graylog.org).

You can forward simple name-value pairs where the name starts with a dot or underscore. If names of your name-value pairs include dots other than the first character, you should use JSON formatting directly instead of the GELF template and send logs to a raw TCP port in Graylog, which can then extract fields from nested JSON. Version 3.21 and later also supports TLS-encrypted connection to the Graylog server.

## Prerequisites

Install the `axosyslog-scl` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md). On [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md), the SCL files are part of the `axosyslog` base package.

Your configuration must also contain `@include "scl.conf"`, which the default configuration file already does. If the SCL files are missing, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).

```shell
@include "scl.conf"
```

## Declaration:

```shell
graylog2();
```

## Example: Using the graylog2() driver

You can send syslog messages to Graylog using the `graylog2()` destination. The `graylog2()` destination uses the GELF template, the native data format of Graylog.

1. On the Graylog side, configure a GELF TCP input. For more information, see the relevant [Graylog](http://docs.graylog.org) documentation.
2. On the AxoSyslog side, configure the name or IP address of the host running Graylog.

   ```shell
   destination d_graylog {
     graylog2(
       host("172.16.146.142")
       transport(tcp)
     );
   };
   ```

   If you parsed your messages using `syslog-n`g, the template also forwards any name-value pairs where the name starts with a dot or underscore.

> **Note:**
> If there is a dot in a field name other than the first character, AxoSyslog creates nested JSON while formatting the message. Nested JSON is not automatically parsed in GELF messages.

## Sending nested JSON to Graylog

While sending nested JSON inside GELF is possible, it is not convenient. If you use parsing and normalization and dot notation in field names, use pure JSON instead of GELF to forward your messages.

1. On the Graylog side, create a new raw TCP input.
2. Still in Graylog, once the raw TCP input is ready, add a JSON extractor to it.
3. On the AxoSyslog side, use a network destination combined with a template utilizing format-json as shown in the example below:

   ```shell
   destination d_jsontcp {
     network(
       "172.16.146.142"
       port("5555")
       transport(tcp)
       template("$(format-json --scope all-nv-pairs)\n")
     );
   };
   ```

---

[graylog2() destination options](https://axoflow.com/docs/axosyslog-core/4.28/chapter-destinations/configuring-destinations-graylog/reference-destination-graylog/index.md)

Last modified August 2, 2026: [Adds required modules/packages to install and destination pages (553d6d9b)](https://github.com/axoflow/axosyslog-core-docs/commit/553d6d9be9a0e3ef444e62cc5351dd2ac764f01d)