We have been running CloudTrail inputs from AWS since version 2.X. We are currently running version 3.3.11 and have been for several months. While working on something else I noticed a ton of the following messages in the /var/log/graylog-server/server.log files dating back to March 16.
WARN [CloudtrailSNSNotificationParser] Message is empty. Processing of message has been aborted. Verify that the SQS subscription in AWS is NOT set to send raw data.
There are 150-200 of these messages per minute. As far as I can tell there have been no changes in either the AWS SQS or SNS or graylog configurations in a very long time. All of the inputs are otherwise working normally.
Does anyone have a clue as to what is causing these messages and how to shut them off.