# Empty mandatory "short\_message" field

**URL:** <https://community.graylog.org/t/empty-mandatory-short-message-field/11413>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, nxlog, nodatanx\
**Created:** [July 30, 2019, 10:14pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413 "2019-07-30T22:14:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![adam.turner](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@adam.turner](https://community.graylog.org/u/adam.turner)\
**Post date:** [July 30, 2019, 10:14pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/1 "2019-07-30T22:14:05Z")

</div>

Apologies if this is considered a duplicate post, but I see lots of these with no clear resolution. We have Windows Event Logs being sent to Graylog via an nxlog configuration on the sidecar and we still are seeing this error in server.log. We have tried the following with no improvement. Is there a long term fix to this? I do know it is coming from one of the 3 logs (System, Application, Security). I am not able to find a corresponding log entry on the server with an empty message field.

if ($short\_message == “”) drop ();

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [July 31, 2019, 7:57am UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/2 "2019-07-31T07:57:03Z")

</div>

as you did not share your configuration - the only answer is: you have something missing in the configuration if that happens.

---

<div class="post-metadata">

**Author:** ![adam.turner](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@adam.turner](https://community.graylog.org/u/adam.turner)\
**Post date:** [July 31, 2019, 2:40pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/3 "2019-07-31T14:40:22Z")

</div>

Graylog 3.0.2+1686930, codename Space Moose  
JVM: Oracle Corporation 1.8.0\_191 on Linux 4.15.0-46-generic  
ES Version: I am looking for this now…

nxlog configuration:

```auto
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module xm_fileop
    <Schedule>
        When @daily
        Exec file_cycle('%ROOT%\data\nxlog.log', 7);
     </Schedule>
</Extension>

<Extension gelfExt>
  Module xm_gelf
  # Avoid truncation of the short_message field to 64 characters.
  ShortMessageLength 65536
</Extension>

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos True
        ReadFromLast True
        
        #Channel System
        #<QueryXML>
        # <QueryList>
        # <Query Id='1'>
        # <Select Path='Security'>*[System/Level=4]</Select>
        # </Query>
        # </QueryList>
        #</QueryXML>
</Input>

#<Input file>
#	Module im_file
#	File 'C:\Windows\MyLogDir\\*.log'
#	PollInterval 1
#	SavePos	True
#	ReadFromLast True
#	Recursive False
#	RenameCheck False
#	Exec $FileName = file_name(); # Send file name with each message
#/Input>

<Output gelf>
	Module om_tcp
	Host 10.225.100.61
	Port 12201
	OutputType GELF_TCP
	<Exec>
	  # These fields are needed for Graylog
	  $gl2_source_collector = '${sidecar.nodeId}';
	  $collector_node_id = '${sidecar.nodeName}';
	  $short_message = " ";
# MVR Change: #
# $short_message = '$raw_event';
# if ($short_message == "") drop();
#Replace newlines, tabs and carriage returns with blanks:
    $Short_message = replace($Short_message, "\t", " ");
    $Short_message = replace($Short_message, "\n", " ");
    $Short_message = replace($Short_message, "\r", " ");
    $Short_message = replace($Short_message, "", " ");

# Replace newlines, tabs and carriage returns with blanks:
    $Message = replace($Message, "\t", " "); 
    $Message = replace($Message, "\n", " "); 
    $Message = replace($Message, "\r", " ");
	</Exec>
</Output>

<Route route-1>
  Path eventlog => gelf
</Route>
#<Route route-2>
 # Path file => gelf
#</Route>

```

---

<div class="post-metadata">

**Author:** ![adam.turner](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@adam.turner](https://community.graylog.org/u/adam.turner)\
**Post date:** [July 31, 2019, 2:48pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/4 "2019-07-31T14:48:18Z")

</div>

ElasticSearch Version 6.8.1

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [July 31, 2019, 4:07pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/5 "2019-07-31T16:07:55Z")

</div>

you might want to use the power of markdown to make your configuration readable?

---

<div class="post-metadata">

**Author:** ![adam.turner](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@adam.turner](https://community.graylog.org/u/adam.turner)\
**Post date:** [July 31, 2019, 4:45pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/6 "2019-07-31T16:45:29Z")

</div>

As part of testing, we used the below nxlog config. The thought was to prevent an empty short\_message field being sent to Graylog. However, we still receive the same error message on the Graylog server.

```auto
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module xm_fileop
    <Schedule>
        When @daily
        Exec file_cycle('%ROOT%\data\nxlog.log', 7);
     </Schedule>
</Extension>

<Extension gelfExt>
  Module xm_gelf
  # Avoid truncation of the short_message field to 64 characters.
  ShortMessageLength 65536
</Extension>

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos True
        ReadFromLast True
        
        #Channel System
        #<QueryXML>
        # <QueryList>
        # <Query Id='1'>
        # <Select Path='Security'>*[System/Level=4]</Select>
        # </Query>
        # </QueryList>
        #</QueryXML>
</Input>

#<Input file>
#	Module im_file
#	File 'C:\Windows\MyLogDir\\*.log'
#	PollInterval 1
#	SavePos	True
#	ReadFromLast True
#	Recursive False
#	RenameCheck False
#	Exec $FileName = file_name(); # Send file name with each message
#/Input>

<Output gelf>
	Module om_tcp
	Host 10.225.100.61
	Port 12201
	OutputType GELF_TCP
	<Exec>
	  # These fields are needed for Graylog
	  $gl2_source_collector = '${sidecar.nodeId}';
	  $collector_node_id = '${sidecar.nodeName}';
	  $Short_message = "Look at the Message field.";
# MVR Change: #
# $short_message = '$raw_event';
# if ($short_message == "") drop();
#Replace newlines, tabs and carriage returns with blanks:
# $Short_message = replace($Short_message, "\t", " ");
# $Short_message = replace($Short_message, "\n", " ");
# $Short_message = replace($Short_message, "\r", " ");
# $Short_message = replace($Short_message, "", " ");

# Replace newlines, tabs and carriage returns with blanks:
# $Message = replace($Message, "\t", " "); 
# $Message = replace($Message, "\n", " "); 
# $Message = replace($Message, "\r", " ");
	</Exec>
</Output>

<Route route-1>
  Path eventlog => gelf
</Route>
#<Route route-2>
 # Path file => gelf
#</Route>

```

---

<div class="post-metadata">

**Author:** ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)\
**Post date:** [July 31, 2019, 6:13pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/7 "2019-07-31T18:13:13Z")

</div>

I wonder if the field names in nxlog are case sensitive or not?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 14, 2019, 6:13pm UTC](https://community.graylog.org/t/empty-mandatory-short-message-field/11413/8 "2019-08-14T18:13:19Z")

</div>

Closed on August 14, 2019, 6:13pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.