ERROR [DecodingProcessor] Unable to decode raw message RawMessage

Graylog Central (peer support)
1

Need help, more messages is not decoding

2018-03-23T12:20:34.670+02:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=d2c799d2-2e83-11e8-985f-00163e81db30, journalOffset=12475868190, codec=gelf, payloadSize=8, timestamp=2018-03-23T10:20:34.669Z, remoteAddress=/10.10.10.96:54515} on input <57358639e4b05b0a3e576fcd>.
2018-03-23T12:20:34.670+02:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=d2c799d2-2e83-11e8-985f-00163e81db30, journalOffset=12475868190, codec=gelf, payloadSize=8, timestamp=2018-03-23T10:20:34.669Z, remoteAddress=/10.10.10.96:54515}
com.fasterxml.jackson.databind.JsonMappingException: No content to map due to end-of-input
 at [Source: ; line: 1, column: 0]
        at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:270) ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3854) ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3799) ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2397) ~[graylog.jar:?]
        at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:127) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
        at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131]
2018-03-23T12:20:34.688+02:00 ERROR [GelfCodec] Could not parse JSON, first 400 characters: 
com.fasterxml.jackson.databind.JsonMappingException: No content to map due to end-of-input
 at [Source: ; line: 1, column: 0]
        at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:270) ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3854) ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3799) ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2397) ~[graylog.jar:?]
        at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:127) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
        at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131]

Environment

  • Graylog Version: 2.3.2
  • Elasticsearch Version: 5.6.4
  • MongoDB Version: 3.4.4
  • Operating System: Ubuntu 16.04.2 LTS amd64
  • Browser version: Firefox 52 ESR
2

Some client (10.10.10.96:54515) sent an invalid GELF message (i. e. no payload at all: “No content to map due to end-of-input”).

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.