ERROR: org.graylog2.inputs.codecs.GelfCodec - Could not parse JSON, first 400 characters: {"host":"app","version":"1.1","short_message

Graylog Central (peer support)
1

ERROR: org.graylog2.inputs.codecs.GelfCodec - Could not parse JSON, first 400 characters: {“host”:“app”,“version”:“1.1”,“short_message”:“U2FsdGVkX1/lqchvd7Pxu7WU5V+HkpPOE3+9767hfY34uBs7ehnHQyCbBZTk57o5qCQuxdMyEMU75571I5nEUdJy63RMGj1Qm/GhoRRSCuZVkjMIQ2m/ptlj/Pa/3MzK282jGRG57sFXEgOETKtPhgqzbp3KBqQMIyQVNJ26J0kaqamUEvfGt/sVlPSGG6U7YKoiLjvPBkLwvlGtlku/UogZHfZP0eoKnJUTr6zswMonq2/P57TIUykre”,“full_message”:"U2FsdGVkX1/lqchvd7Pxu7WU5V+HkpPOE3+9767hfY34uBs7ehnHQyCbBZTk57o5qCQuxdMyEMU75571I5nEU…
com.fasterxml.jackson.core.io.JsonEOFException: Unexpected end-of-input: was expecting closing quote for a string value
at [Source: (StringReader); line: 1, column: 2753803]
at com.fasterxml.jackson.core.base.ParserMinimalBase._reportInvalidEOF(ParserMinimalBase.java:618) ~[graylog.jar:?]
at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._finishString2(ReaderBasedJsonParser.java:2037) ~[graylog.jar:?]
at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._finishString(ReaderBasedJsonParser.java:2024) ~[graylog.jar:?]
at com.fasterxml.jackson.core.json.ReaderBasedJsonParser.getText(ReaderBasedJsonParser.java:278) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.deser.std.BaseNodeDeserializer.deserializeObject(JsonNodeDeserializer.java:264) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.deser.std.JsonNodeDeserializer.deserialize(JsonNodeDeserializer.java:68) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.deser.std.JsonNodeDeserializer.deserialize(JsonNodeDeserializer.java:15) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.ObjectMapper._readTreeAndClose(ObjectMapper.java:4057) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2552) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:130) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:156) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:94) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:95) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:49) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:750) [?:1.8.0_345]
2023-03-02 11:21:21,433 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Unable to decode raw message RawMessage{id=5c030d90-b8ec-11ed-b3f7-0242ac120002, messageQueueId=2245161201, codec=gelf, payloadSize=2743161, timestamp=2023-03-02T11:21:21.385Z, remoteAddress=/10.3.2.35:41726} on input <61f1831b42ec58770fbefcd5>.
2023-03-02 11:21:21,434 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=gbnahxxxxxxxxxxggfgfxxxxx, messageQueueId=2245161201, codec=gelf, payloadSize=2743161, timestamp=2023-03-02T11:21:21.385Z, remoteAddress=/10.3.2.35:41726}
com.fasterxml.jackson.core.io.JsonEOFException: Unexpected end-of-input: was expecting closing quote for a string value
at [Source: (StringReader); line: 1, column: 2753803]

2

The short answer is that your input is not receiving a proper JSON. Revise from who/what is sending to fix that or change the input to match what is coming in… last resort, you can make that input RAW to see what is coming in.

BTW, it’s unhelpful to just post an error message without any more detail. Here are some links to how to post:

2 Likes
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.