Error processing message RawMessage

Graylog Central (peer support)
1

After an update from Graylog 2.2 to Graylog 2.3 some messages are dropped.

I have NxLog which sends logs in GELF TCP to Graylog.

In graylog log file I have this:

ERROR [DecodingProcessor] Error processing message RawMessage{id=b76759d4-8c9c-11e7-aa0a-000c29a47c92, journalOffset=1494373102, codec=gelf, payloadSize=318, timestamp=2017-08-29T09:30:37.788Z, remoteAddress=/x.x.x.x:59530}
java.lang.IllegalArgumentException: GELF message <b76759d4-8c9c-11e7-aa0a-000c29a47c92> (received from <134.214.126.209:59530>) has empty mandatory "short_message" field.

I have already checked Nxlog and I have Exec $short_message = $raw_event; in output section of config file.

Any thoughts?

Thanks.

2

Maybe $raw_event was empty.

There’s no way to debug this issue without further information.

3

I have this issue only with some messages so I agree that $raw_event is sometimes empty.
Is it normal that $raw_event is sometimes empty? The input of nxlog is a text file.

4

I don’t know if it’s normal, but I think it could happen if the file contains empty lines.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.