---
description: Learn how to use the Graylog Extended Format logging driver with Docker Engine
keywords: graylog, gelf, logging, driver
title: Graylog Extended Format logging driver
aliases:
  - /engine/reference/logging/gelf/
  - /engine/admin/logging/gelf/
  - /config/containers/logging/gelf/
---

The `gelf` logging driver is a convenient format that's understood by a number of tools such as
[Graylog](https://www.graylog.org/), [Logstash](https://www.elastic.co/products/logstash), and
[Fluentd](https://www.fluentd.org). Many tools use this format.

In GELF, every log message is a dict with the following fields:

- Version
- Host (who sent the message in the first place)
- Timestamp
- Short and long version of the message
- Any custom fields you configure yourself

## Usage

To use the `gelf` driver as the default logging driver, set the `log-driver` and
`log-opt` keys to appropriate values in the `daemon.json` file, which is located
in `/etc/docker/` on Linux hosts or `C:\ProgramData\docker\config\daemon.json`
on Windows Server. For more about configuring Docker using `daemon.json`, see
[daemon.json](/reference/cli/dockerd.md#daemon-configuration-file).

The following example sets the log driver to `gelf` and sets the `gelf-address`
option.

```json
{
  "log-driver": "gelf",
  "log-opts": {
    "gelf-address": "udp://1.2.3.4:12201"
  }
}
```

Restart Docker for the changes to take effect.

> [!NOTE]
>
> `log-opts` configuration options in the `daemon.json` configuration file must
> be provided as strings. Boolean and numeric values (such as the value for
> `gelf-tcp-max-reconnect`) must therefore be enclosed in quotes (`"`).

You can set the logging driver for a specific container by setting the
`--log-driver` flag when using `docker container create` or `docker run`:

```console
$ docker run \
      --log-driver gelf --log-opt gelf-address=udp://1.2.3.4:12201 \
      alpine echo hello world
```

### GELF options

The `gelf` logging driver supports the following options:

| Option                     | Required | Description                                                                                                                                                                                                                                                                         | Example value                                      |
| :------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------- |
| `gelf-address`             | required | The address of the GELF server. `tcp` and `udp` are the only supported URI specifier and you must specify the port.                                                                                                                                                                 | `--log-opt gelf-address=udp://192.168.0.42:12201`  |
| `gelf-compression-type`    | optional | `UDP Only` The type of compression the GELF driver uses to compress each log message. Allowed values are `gzip`, `zlib` and `none`. The default is `gzip`. Note that enabled compression leads to excessive CPU usage, so it's highly recommended to set this to `none`.            | `--log-opt gelf-compression-type=gzip`             |