ERROR: org.graylog2.inputs.codecs.GelfCodec - Could not parse JSON, first 400 characters: A?H?S?>N?)?}a+&?

[rajtarange]

Hi Team ,
I am getting below error,

[tmacgbay]

What you are sending to the GELF input is not properly formatted… I can’t tell anything else about what is going on though… you would need to post more information… It’s all a black box until you tell us what
you have, and how you are doing it. Posting text wherever possible is better than text in a picture.

NOTE: moved the post to Graylog Central where questions are asked.

Here are posts on how to ask questions in the forum…

Tips for Posting Questions that Get Answers

TIPS for Posting Questions that Get Answers: *The following is a compendium of tips to help you organize your question and have better success for getting a solution to the incident you are having. First, a short list, then some detail on how to pull and post information from your systems. When you create a new Topic for the community to review with you: Search Graylog Documentation, the Graylog community forum, Google … the answer may be out there! Have a short informative subject such as:…

How to Post a Question in the Community that Gets Responses

This platform is made with love for community discussions on the open source tool Graylog, it components and usage. Here’s a Graylog support-inspired template (thank you, @aaronsachs ) that’ll get responses: Description of your problem <!-- Use this section to describe the problem that you're encountering. Please include any screenshots or recordings of the problem you're running into.--> Description of steps you’ve taken to attempt to solve the issue <!-- Use this section to provide detail…

[rajtarange]

@tmacgbay sending below data to graylog using java utility

{
	"version": "1.1",
	"host": "example.org",
	"short_message": "A short message that helps you identify what is going on",
	"full_message": "Backtrace here\n\nmore stuff",
	"timestamp": 1385053862.3072,
	"level": 1,
	"_user_id": 9001,
	"_some_info": "foo",
	"_some_env_var": "bar"
}

and getting below exception

2023-01-05 07:01:39,904 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Unable to decode raw message RawMessage{id=cd976de0-8cc6-11ed-a312-0242ac130004, messageQueueId=464, codec=gelf, payloadSize=37, timestamp=2023-01-05T07:01:39.902Z, remoteAddress=/172.19.0.1:41316} on input <63b5746f2760d74efd1355d9>.
graylog_1        | 2023-01-05 07:01:39,904 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=cd976de0-8cc6-11ed-a312-0242ac130004, messageQueueId=464, codec=gelf, payloadSize=37, timestamp=2023-01-05T07:01:39.902Z, remoteAddress=/172.19.0.1:41316}
graylog_1        | com.fasterxml.jackson.core.JsonParseException: Unrecognized t': was expecting ('true', 'false' or 'null')
graylog_1        |  at [Source: (String)"$
graylog_1        |
                  "; line: 1, column: 19]
graylog_1        |      at com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1804) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:703) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2853) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1899) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:757) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.databind.ObjectMapper._readTreeAndClose(ObjectMapper.java:4043) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2552) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:130) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:156) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:94) [graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:95) [graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:49) [graylog.jar:?]
graylog_1        |      at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
graylog_1        |      at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
graylog_1        |      at java.lang.Thread.run(Thread.java:750) [?:1.8.0_332]
graylog_1        | 2023-01-05 07:01:39,905 ERROR: org.graylog2.inputs.codecs.GelfCodec - Could not parse JSON, first 400 characters:  ?q|???q,f???M?:?#K??q?    ?????H
graylog_1        | com.fasterxml.jackson.core.JsonParseException: Unrecognized token '?q': was expecting ('true', 'false' or 'null')
graylog_1        |  at [Source: (String)" ?q|???q,f???M?:?#K??q?        ?????H"; line: 1, column: 5]
graylog_1        |      at com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1804) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:703) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2853) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1899) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:757) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.databind.ObjectMapper._readTreeAndClose(ObjectMapper.java:4043) ~[graylog.jar:?]
graylog_1        |      at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2552) ~[graylog.jar:?]
graylog_1        |      at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:130) [graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:156) [graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:94) [graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:95) [graylog.jar:?]
graylog_1        |      at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:49) [graylog.jar:?]
graylog_1        |      at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
graylog_1        |      at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
graylog_1        |      at java.lang.Thread.run(Thread.java:750) [?:1.8.0_332]
graylog_1        | 2023-01-05 07:01:39,905 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Unable to decode raw message RawMessage{id=cd9794f0-8cc6-11ed-a312-0242ac130004, messageQueueId=465, codec=gelf, payloadSize=33, timestamp=2023-01-05T07:01:39.903Z, remoteAddress=/172.19.0.1:41316} on input <63b5746f2760d74efd1355d9>.
graylog_1        | 2023-01-05 07:01:39,905 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=cd9794f0-8cc6-11ed-a312-0242ac130004, messageQueueId=465, codec=gelf, payloadSize=33, timestamp=2023-01-05T07:01:39.903Z, remoteAddress=/172.19.0.1:41316}

[tmacgbay]

The error states there is a 't' at line 1 column 19 where it is expecting the true, false or null it then says Unrecognized token '?q' with notes around it with things like characters: ?q|???q,f???M?:?#K??q? ?????H

I don’t think the GELF Input is receiving what you think you are sending. You can use TCPDump on the port (There are other post on the forum for how if you need) or you can change the receiving input to RAW to get just what is being sent to it and test out the results.

NOTE: I used the forum tool </> to reformat your posts to make them more easily readable.