Assuming the logstash gelf output is using this gelf library, then my reading of the code is that it unconditionally does 'Zlib::Deflate.deflate(hash.to_json).bytes' before adding the datagram to the queue.
If you are able to run a packet trace it should be pretty obvious whether the packets contains JSON or compressed JSON.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.