Graylog output plugin: full_message is handled like a custom field

[alespour]

Relevent telegraf.conf

[[outputs.graylog]]
  ## Endpoints for your graylog instances.
  servers = ["udp://127.0.0.1:12201"]

System info

Telegraf 1.20

Docker

No response

Steps to reproduce

Graylog output plugin does not handle default gelf field "full_message" as default field. It treates it as custom field and adds "_" at beginning. Thats not correct, like "short_message" field, also full_message field must not start with underscore (see https://docs.graylog.org/en/4.0/pages/gelf.html).

Mentioned by @1tft in #9862.

1. data with a tag or field named full_message
2. it is sent in GELF payload as "_full_message": "whatever",

Expected behavior

full_message field name should not be prefixed with underscore.

Actual behavior

full_message field name is prefixed with underscore.

Additional info

No response

[alespour]

Please assign this to me (alespour) if you will.

@1tft There is a configuration option short_message_field, would similar ie. full_message_field be handy do you think? Thanks!

[1tft]

I dont think full_message_field is necessary, because its a bugfix. Nobody should have expected that full_message field has an underscore, because there exists no Gelf version where this is valid.
Also "short_message_field" option should be removed in future releases.

[srebhan]

Hey @alespour and @1tft, does #10209 fix the issue for you?

[1tft]

@srebhan Made some tests with telegraf-1.21.0~4737bebc-0.x86_64.rpm and logs successfully transferred to Graylog with all fields. Telegraf graylog output seems now to produce valid gelf.
Thank you!

[srebhan]

So I'll close the issue and also the PR. If you see any issues, please open a new issue or reopen this one.