# GELF HTTP does not process messages **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [November 29, 2018, 11:18am UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842 "2018-11-29T11:18:17Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![atriumcarceri](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/atriumcarceri/32/3775_2.png) [@atriumcarceri](https://community.graylog.org/u/atriumcarceri)\ **Post date:** [November 29, 2018, 11:18am UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/1 "2018-11-29T11:18:17Z")
Hello! I sending events from minio to endpoint graylog input, tcp gelf http. Count of connections change, but no processes message at all. I catch some tcpdump from it. its first http packet, 10.10.10.10 its ip graylog node > **Summary** > > Frame 4: 1262 bytes on wire (10096 bits), 1262 bytes captured (10096 bits) > Ethernet II, Src: HuaweiTe\_18:bf:91 (fa:fa:fa:fa:fa:fa:fa), Dst: Vmware\_a4:77:e4 (fb:fb:fb:fb:fb:fb) > Internet Protocol Version 4, Src: 172.20.6.103, Dst: 10.10.10.10 > 0100 … = Version: 4 > … 0101 = Header Length: 20 bytes (5) > Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) > Total Length: 1248 > Identification: 0xb7c2 (47042) > Flags: 0x4000, Don’t fragment > Time to live: 62 > Protocol: TCP (6) > Header checksum: 0x87b2 [validation disabled] > [Header checksum status: Unverified] > Source: 172.20.6.103 > Destination: 10.10.10.10 > Transmission Control Protocol, Src Port: 44898, Dst Port: 11010, Seq: 1, Ack: 1, Len: 1208 > Source Port: 44898 > Destination Port: 11010 > [Stream index: 0] > [TCP Segment Len: 1208] > Sequence number: 1 (relative sequence number) > [Next sequence number: 1209 (relative sequence number)] > Acknowledgment number: 1 (relative ack number) > 0101 … = Header Length: 20 bytes (5) > Flags: 0x018 (PSH, ACK) > Window size value: 229 > [Calculated window size: 29312] > [Window size scaling factor: 128] > Checksum: 0x7db2 [unverified] > [Checksum Status: Unverified] > Urgent pointer: 0 > [SEQ/ACK analysis] > [iRTT: 0.003999000 seconds] > [Bytes in flight: 1208] > [Bytes sent since last PSH flag: 1208] > [Timestamps] > TCP payload (1208 bytes) > Hypertext Transfer Protocol > POST /gelf HTTP/1.1\r\n > [Expert Info (Chat/Sequence): POST /gelf HTTP/1.1\r\n] > [POST /gelf HTTP/1.1\r\n] > [Severity level: Chat] > [Group: Sequence] > Request Method: POST > Request URI: /gelf > Request Version: HTTP/1.1 > Host: 10.10.10.10:11010\r\n > User-Agent: Go-http-client/1.1\r\n > Content-Length: 1051\r\n > [Content length: 1051] > Content-Type: application/json\r\n > Accept-Encoding: gzip\r\n > \r\n > [Full request URI: [http://10.10.10.10:11010/gelf](http://10.10.10.10:11010/gelf)] > [HTTP request 1/1] > [Response in frame: 6] > File Data: 1051 bytes > JavaScript Object Notation: application/json > JSON compact form: {…} > Object > Member Key: EventName > Member Key: Key > String value: bucket/5845e608fb0b0755fa99d7e7.png > Key: Key > Member Key: Records then node answer 202 > **Summary** > > Frame 6: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) > Ethernet II, Src: Vmware\_a4:77:e4 (fb:fb:fb:fb:fb:fb), Dst: HuaweiTe\_18:bf:91 (fa:fa:fa:fa:fa:fa:fa) > Internet Protocol Version 4, Src: 10.10.10.10, Dst: 172.20.6.103 > 0100 … = Version: 4 > … 0101 = Header Length: 20 bytes (5) > Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) > Total Length: 108 > Identification: 0xc497 (50327) > Flags: 0x4000, Don’t fragment > Time to live: 64 > Protocol: TCP (6) > Header checksum: 0x7d51 [validation disabled] > [Header checksum status: Unverified] > Source: 10.10.10.10 > Destination: 172.20.6.103 > Transmission Control Protocol, Src Port: 11010, Dst Port: 44898, Seq: 1, Ack: 1209, Len: 68 > Source Port: 11010 > Destination Port: 44898 > [Stream index: 0] > [TCP Segment Len: 68] > Sequence number: 1 (relative sequence number) > [Next sequence number: 69 (relative sequence number)] > Acknowledgment number: 1209 (relative ack number) > 0101 … = Header Length: 20 bytes (5) > Flags: 0x018 (PSH, ACK) > Window size value: 8030 > [Calculated window size: 32120] > [Window size scaling factor: 4] > Checksum: 0xf901 [unverified] > [Checksum Status: Unverified] > Urgent pointer: 0 > [SEQ/ACK analysis] > [iRTT: 0.003999000 seconds] > [Bytes in flight: 68] > [Bytes sent since last PSH flag: 68] > [Timestamps] > TCP payload (68 bytes) > Hypertext Transfer Protocol > HTTP/1.1 202 Accepted\r\n > [Expert Info (Chat/Sequence): HTTP/1.1 202 Accepted\r\n] > [HTTP/1.1 202 Accepted\r\n] > [Severity level: Chat] > [Group: Sequence] > Response Version: HTTP/1.1 > Status Code: 202 > [Status Code Description: Accepted] > Response Phrase: Accepted > Content-Length: 0\r\n > [Content length: 0] > Connection: keep-alive\r\n > \r\n > [HTTP response 1/1] > [Time since request: 0.001567000 seconds] > [Request in frame: 4] I see that i have json there. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [November 29, 2018, 11:41am UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/2 "2018-11-29T11:41:58Z")
When you browse the **System \> Inputs** section and go to the GELF input, there should be a button on the right saying something like “_Show received messages_”… What does that show you? - Is this the only input running on the host? - If there are other inputs, are their messages showing up? ---
**Author:** ![atriumcarceri](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/atriumcarceri/32/3775_2.png) [@atriumcarceri](https://community.graylog.org/u/atriumcarceri)\ **Post date:** [November 29, 2018, 12:24pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/3 "2018-11-29T12:24:08Z")
Ony node only, input started and message in this input is 0. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [November 29, 2018, 12:30pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/4 "2018-11-29T12:30:59Z")
Then it’s not a matter of the input not processing messages. Then it’s a matter of messages not arriving at the input. Now you know where to troubleshoot 🙂 ---
**Author:** ![atriumcarceri](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/atriumcarceri/32/3775_2.png) [@atriumcarceri](https://community.graylog.org/u/atriumcarceri)\ **Post date:** [November 29, 2018, 1:35pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/5 "2018-11-29T13:35:17Z")
have no idea. the message is comes to node and graylog answer with 202, that mean that message proceed to processing ( [http://docs.graylog.org/en/2.4/pages/sending\_data.html#gelf-via-http](http://docs.graylog.org/en/2.4/pages/sending_data.html#gelf-via-http) ). And there is 9 my attempt [https://prnt.sc/loicff](https://prnt.sc/loicff) ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [November 29, 2018, 7:07pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/6 "2018-11-29T19:07:53Z")
Hey that’s great troubleshooting so far! Nice! So… that leaves the question where those messages have gone 😃 EDIT: Your screenshot, which I’ve included here for easy viewing, indicates that a few kB of data was indeed received. ![Unknown](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/35647486b78f6da0a937ef3bb27abdabdb174fcc.png) So what happens when you bang on that “ **Show received messages** ” button? ---
**Author:** ![atriumcarceri](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/atriumcarceri/32/3775_2.png) [@atriumcarceri](https://community.graylog.org/u/atriumcarceri)\ **Post date:** [November 29, 2018, 7:41pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/7 "2018-11-29T19:41:06Z")
only one test message, generated manually from same host, i think thats it ![Screenshot_16](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/95d9e041923a61de7b26ddcbae940e3fccdd8437.png) ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [November 29, 2018, 8:10pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/8 "2018-11-29T20:10:01Z")
Hmmm, that’s pretty odd. No way does 9.4kB add up to one message… ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [December 13, 2018, 8:21pm UTC](https://community.graylog.org/t/gelf-http-does-not-process-messages/7842/9 "2018-12-13T20:21:32Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.