Debugging pipeline rules


#1

hi,

where can I find the errors in the pipeline rules? The pipeline page tells me that there are quite a lot of errors, but I cannot see them in the server logs. I would like to see what causes the problems.


(Jochen) #2

Where and what do you see exactly?


#3

In /var/logs/graylog/server/current I see the following:

2017-06-16 19:08:13,225 WARN : org.graylog2.shared.events.DeadEventLoggingListener - Received unhandled event of type <org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.State> from event bus <AsyncEventBus{graylog-eventbus}>

I assume this is a problem with the pipeline rule I just added?

rule "parse ACCESS log timestamp"
when
    has_field("event_ts")
then
    set_field("timestamp", $message.event_ts);    
end

So how can I debug this rule further? The error above is pretty cryptic.


#4

I saw these, too. And on the pipeline page there was info like 2 msg/s errors 2 msg/sec. (I have no access to the graylog right now).


(system) #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.