Graylog: Choosing the right protocol

This documentation is part of the Choose input types guide. You can view the complete guide here: How to choose the right Graylog input type.

👋 Welcome to Stackhero documentation

Stackhero offers a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Count on an unlimited, dedicated SMTP email server included with your service.
• Apply updates easily with a single click, with no manual intervention required.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), providing your team with secure, direct access.
• Benefit from strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbours.

Focus on your data, not your tools: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

Once you have chosen the format (we hope you chose GELF!), you need to select the communication protocol between TCP and UDP.

UDP protocol

The UDP protocol is very simple. Your application sends the message to the server without waiting for a receipt confirmation. There is no dialogue between the client and the server, which means the server does not confirm receipt of the message.

The advantage of this approach is that if your Graylog server is slow or unavailable, it will not impact your application's performance. The downside is that you cannot guarantee that every log sent by your application will actually reach the server. Also, encryption is not available with UDP.

Pros

1. Does not impact your application if Graylog is slow or unavailable.

Cons

1. Some messages may be lost.
2. Encryption is not available.
3. Message size is limited to 8192 bytes.

TCP protocol

The TCP protocol, unlike UDP, allows for an exchange of information between your application and Graylog. This means you receive confirmation that the message has been received by Graylog.

The benefit of TCP is that you can resend a message if it is not received by Graylog (for example, if the server is unavailable). The drawback is that if Graylog is slow or unresponsive, your application must wait for a response or a timeout, which can slow it down.

Another advantage is that you can encrypt your communications with TLS (also known as SSL).

Pros

• Ensures that the message has been received.
• Encryption is available (TLS).
• No message size limitation

Cons

• Can slow down the sender if Graylog is slow to respond or unavailable.