Errors: empty mandatory "short_message" field

Graylog Central (peer support)
1

After updating to the newest Graylog version (2.4.6) I’m getting lots of messages like this in the Graylog logs:
java.lang.IllegalArgumentException: GELF message <67ea9901-c555-11e8-967d-0242ac120002> (received from <172.4.3.2.18:57075>) has empty mandatory "short_message" field.

This is most probably due to logfiles that have lines with only a TAB.

I can not change the format of the ingested logfiles, but would it help if I add a filter to the Logstash config? Something like this:

if [message] =~ /^\s*$/ {
  drop { }
}
1 Like
2

If you already have a logstash sitting before Graylog, why not adding the short_message field and not only drop?

3

According to the GELF output plugin documentation for short_message: “If the field does not exist or is empty, the event message is taken instead.” - which is OK for me.

But in this special case message = TAB - and I assume short_message will be TAB too. And because of

if (StringUtils.isBlank(shortMessageNode.asText()) && StringUtils.isBlank(messageNode.asText())) {
                throw new IllegalArgumentException(prefix + "has empty mandatory \"short_message\" field.");
}

in GelfCodec.java there are lots of exceptions in the Graylog server.

4

Just to have your Github issue synced here:

https://github.com/Graylog2/graylog2-server/issues/5171

thank you for the clarification!

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.