# Error processing message RawMessage

**URL:** <https://community.graylog.org/t/error-processing-message-rawmessage/2284>\
**Category:** Graylog Central (peer support)\
**Created:** [August 29, 2017, 9:37am UTC](https://community.graylog.org/t/error-processing-message-rawmessage/2284 "2017-08-29T09:37:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vladost](https://avatars.discourse-cdn.com/v4/letter/v/f05b48/32.png) [@vladost](https://community.graylog.org/u/vladost)\
**Post date:** [August 29, 2017, 9:37am UTC](https://community.graylog.org/t/error-processing-message-rawmessage/2284/1 "2017-08-29T09:37:03Z")

</div>

After an update from Graylog 2.2 to Graylog 2.3 some messages are dropped.

I have NxLog which sends logs in GELF TCP to Graylog.

In graylog log file I have this:

```auto
ERROR [DecodingProcessor] Error processing message RawMessage{id=b76759d4-8c9c-11e7-aa0a-000c29a47c92, journalOffset=1494373102, codec=gelf, payloadSize=318, timestamp=2017-08-29T09:30:37.788Z, remoteAddress=/x.x.x.x:59530}
java.lang.IllegalArgumentException: GELF message <b76759d4-8c9c-11e7-aa0a-000c29a47c92> (received from <134.214.126.209:59530>) has empty mandatory "short_message" field.

```

I have already checked Nxlog and I have Exec $short\_message = $raw\_event; in output section of config file.

Any thoughts?

Thanks.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 29, 2017, 11:15am UTC](https://community.graylog.org/t/error-processing-message-rawmessage/2284/2 "2017-08-29T11:15:56Z")

</div>

Maybe `$raw_event` was empty.

There’s no way to debug this issue without further information.

---

<div class="post-metadata">

**Author:** ![vladost](https://avatars.discourse-cdn.com/v4/letter/v/f05b48/32.png) [@vladost](https://community.graylog.org/u/vladost)\
**Post date:** [August 29, 2017, 12:39pm UTC](https://community.graylog.org/t/error-processing-message-rawmessage/2284/3 "2017-08-29T12:39:49Z")

</div>

I have this issue only with some messages so I agree that $raw\_event is sometimes empty.  
Is it normal that $raw\_event is sometimes empty? The input of nxlog is a text file.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 29, 2017, 1:58pm UTC](https://community.graylog.org/t/error-processing-message-rawmessage/2284/4 "2017-08-29T13:58:01Z")

</div>

> [@vladost](#):
>
> Is it normal that $raw\_event is sometimes empty? The input of nxlog is a text file.

I don’t know if it’s normal, but I think it could happen if the file contains empty lines.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 12, 2017, 1:58pm UTC](https://community.graylog.org/t/error-processing-message-rawmessage/2284/5 "2017-09-12T13:58:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.