After upgrading to 3.3.8 have issues with Short_Message

Hi,

It seems that after this week’s upgrade to 3.3.8 CE, graylog is having issues consuming data from various sources. Typical messages in server.log look like

2020-10-15T18:47:17.173+10:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=0778f036-0ec3-11eb-99cb-ead4a04d912d, journalOffset=213257, codec=gelf, payloadSize=152, timestamp=2020-10-15T08:47:17.171Z, remoteAddress=/10.1.127.1:50803} on input <5ed07ac5b6f9de0436ff0f79>.
2020-10-15T18:47:17.173+10:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=0778f036-0ec3-11eb-99cb-ead4a04d912d, journalOffset=213257, codec=gelf, payloadSize=152, timestamp=2020-10-15T08:47:17.171Z, remoteAddress=/10.1.127.1:50803}
java.lang.IllegalArgumentException: GELF message <0778f036-0ec3-11eb-99cb-ead4a04d912d> (received from <10.1.127.1:50803>) has empty mandatory “short_message” field.

  •    at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:258) ~[graylog.jar:?]*
    
  •    at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:140) ~[graylog.jar:?]*
    
  •    at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]*
    
  •    at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]*
    
  •    at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:90) [graylog.jar:?]*
    
  •    at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:47) [graylog.jar:?]*
    
  •    at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]*
    
  •    at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]*
    
  •    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_265]*
    

I’ve seen several people’s attempts comments on fixing this issue, however none seem to work. Only the graylog CE was updated, none of the clients that report in with SYSLOG, NXLOG (using GELF) or raw files.

I believe that this might be a bug, as only Graylog was upgraded, nothing else was touched.

I’m hoping someone can suggest a solution?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.