Gelf Php Laravel Package

Getting Started

This package is deprecated and archived — use only for legacy maintenance. If stuck with it, install via Composer:

composer require graylog2/gelf-php

The entry points are Gelf\Publisher and Gelf\Message. Minimal setup:

use Gelf\Publisher;
use Gelf\Message;

$publisher = new Publisher('udp://graylog-host:12201');
$publisher->publish(
    (new Message())
        ->setShortMessage('App started')
        ->setLevel(6) // info
        ->setAdditional(['env' => 'production', 'pid' => getmypid()])
);

Verify Graylog’s input settings (UDP/TCP enabled, correct port), and confirm allow_custom_fields is enabled if using setAdditional().

Implementation Patterns

• Monolog integration (legacy): In older Laravel apps, bind GelfHandler to a dedicated channel:

  // logging.php channel
  'graylog' => [
      'driver' => 'monolog',
      'handler' => Monolog\Handler\GelfHandler::class,
      'handler_with' => ['publisher' => new Publisher('tcp://graylog:12201')],
  ],
  

  Then use Log::channel('graylog')->info(...).

• Custom batching wrapper: Since UDP has no delivery feedback, wrap Publisher to group small messages (e.g., 100ms queue) to reduce overhead—though this adds complexity and is rarely needed.

• Context enrichment: Leverage setAdditional() for structured search:

  $message->setAdditional([
      'request_id' => request()->header('X-Request-ID'),
      'user_id' => auth()->id(),
      'duration_ms' => $timer->elapsed(),
  ]);
  

  Graylog will index these as top-level fields.

• Fallback logic: In catch blocks, ensure critical errors fall back to file-based logging (e.g., Monolog’s StreamHandler) since GELF over UDP discards messages silently on network failure.

Gotchas and Tips

• UDP silently truncates: Messages > 8,192 bytes are dropped without error. Enforce size limits:

  $json = json_encode($message->toArray());
  if (strlen($json) > 8191) {
      $message->setShortMessage('[TRUNCATED] ' . $message->getShortMessage());
  }
  

• PHP version pitfalls: Fails on PHP 8.0+ due to deprecated __set_state(), missing scalar type hints, and strict type mismatches. Use ramsey/composer-installers or a maintained fork (php-gelf/php-gelf) for PHP 8 compatibility.

• Timestamp format: GELF requires float seconds since epoch. Message::setTimestamp() defaults to microtime(true), but avoid Carbon (convert via ->getTimestamp() or cast to float).

• No delivery confirmation: UDP means no feedback on message loss. Add custom metrics (e.g., pcntl_alarm timer for delayed flush checks) or switch to TCP for critical logs:

  new Publisher('tcp://graylog:12201'); // More reliable, but blocking
  

• Legacy security: No known CVEs, but the repo has no security policy. Audit your Graylog inputs for malformed messages (e.g., non-UTF-8 strings) since gelf-php doesn’t sanitize.