Fluentd gelf plugin - getting Empty Input

Graylog Central (peer support)
1

Hello All,

This is just a follow up on my old question where I achived to run fluend forwards on my serverless infrastructure. However for log forwading I am using gelf plugin . My config is below :slight_smile:

@type forward bind 0.0.0.0 port 24224

<match fluent.**>
@type copy

@type gelf host fXXX.XXX.internal port 24224 flush_interval 5s @type stdout

and I am encountering
2021-08-10 10:42:29 +0000 [error]: #0 failed to emit fluentd’s log event tag=“fluent.info” event={“port”=>24224, “bind”=>“127.0.0.1”, “message”=>“listening port port=24224 bind="127.0.0.1"”} error_class=EncodingError error=“Empty input (after ) at line 1, column 1 [parse.c:1063] in 'listening port port=24224 bind="127.0.0.1"”
2021-08-10 10:42:29 +0000 [warn]: #0 emit transaction failed: error_class=EncodingError error=“Empty input (after ) at line 1, column 2 [parse.c:1063] in 'fluentd worker is now running worker=0” location=“/usr/lib/ruby/gems/2.7.0/gems/fluent-plugin-gelf-0.2.4/lib/fluent/plugin/gelf_plugin_util.rb:39:in `load’” tag=“fluent.info”

And While I am hitting localhost 24224 I am encountering

2021-08-10 10:59:00 +0000 [error]: #0 failed to emit fluentd’s log event tag=“fluent.warn” event={“host”=>“127.0.0.1”, “msg”=>97, “message”=>“incoming chunk is broken: host="127.0.0.1" msg=97”} error_class=EncodingError error=“Empty input (after ) at line 1, column 1 [parse.c:1063] in 'incoming chunk is broken: host="127.0.0.1" msg=97”
2021-08-10 10:59:00 +0000 [warn]: #0 emit transaction failed: error_class=EncodingError error=“Empty input (after ) at line 1, column 1 [parse.c:1063] in 'incoming chunk is broken: host="127.0.0.1" msg=10” location=“/usr/lib/ruby/gems/2.7.0/gems/fluent-plugin-gelf-0.2.4/lib/fluent/plugin/gelf_plugin_util.rb:39:in `load’” tag=“fluent.warn”
2021-08-10 10:59:00 +0000 [warn]: #0 suppressed same stacktrace

Can anyone help in this , please

Regards,

Irshad

Blockquote

2

Hi, Irshad
Your question is very general
please explain more
Take a look at the link below

3

Hi Bahram,

Sorry for not being specific. My use case is, I am running fluentd (td-agent) container with gelf plugin installed in docker-compose environment where all the other containers shares the host networking. The issue is the container starts-up with “Empty input (after ) at line 1, column 1 [parse.c:1063] in” and I have no idea what is it expecting for bootsrap.

Regards,

Irshad

4

Candidly, this doesn’t really seem like an issue with Graylog itself, or any of it’s component pieces. Rather, this seems like an issue better suited for asking in the Fluentd community. They’re going to be able to best help with any issues directly related to their projects, which is what this appears to be. I’d recommend reaching out in their community Slack channel. If you’ve not joined it already, you can sign up for access to it here Fluent

5

Hi
As Aaron said, You need to pursue fluentd issues in your community
Since Fluentd is as a “Unified logging layer” I suggest checking the scenario with a simpler tool such as a Filebeat

6

Thanks a lot guys, I will take this up with fluent then

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.