Errors: empty mandatory "short_message" field


After updating to the newest Graylog version (2.4.6) I’m getting lots of messages like this in the Graylog logs:
java.lang.IllegalArgumentException: GELF message <67ea9901-c555-11e8-967d-0242ac120002> (received from <>) has empty mandatory "short_message" field.

This is most probably due to logfiles that have lines with only a TAB.

I can not change the format of the ingested logfiles, but would it help if I add a filter to the Logstash config? Something like this:

if [message] =~ /^\s*$/ {
  drop { }

(Jan Doberstein) #2

If you already have a logstash sitting before Graylog, why not adding the short_message field and not only drop?


According to the GELF output plugin documentation for short_message: “If the field does not exist or is empty, the event message is taken instead.” - which is OK for me.

But in this special case message = TAB - and I assume short_message will be TAB too. And because of

if (StringUtils.isBlank(shortMessageNode.asText()) && StringUtils.isBlank(messageNode.asText())) {
                throw new IllegalArgumentException(prefix + "has empty mandatory \"short_message\" field.");

in there are lots of exceptions in the Graylog server.

(Jan Doberstein) #4

Just to have your Github issue synced here:

thank you for the clarification!

(system) #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.