Gelf-input drop data which include "time" field


#1

if there was a “time” field in my log ,i will not able to see them in graylog…

successed:

echo '{"version": "1.1","atime":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog-server 9999

failed:

echo '{"version": "1.1","time":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog-server 9999

(Jochen) #2

What type of input have you created in Graylog and what’s its complete configuration?
Are you using any extractors or pipeline rules in your Graylog cluster (for that input)?


#3

gelf-udp
bind_address: 0.0.0.0
decompress_size_limit: 8388608
override_source:
port: 9991
recv_buffer_size: 262144


(Jochen) #4

Please answer all questions.

Also, you’re using port 9999/udp in your first post but 9991/udp in your second post.


#5

Sorry,i typed wrong port number,it’s 9991,and there is No extractors or pipeline rules used for the input…


(Jochen) #6

I’ve tried to reproduce your problem, but everything works as it should (GELF UDP input on port 12201/udp, no extractors, no pipeline rules).

echo '{"version": "1.1","atime":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog.example.org 12201

Result:

echo '{"version": "1.1","time":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog.example.org 12201

Result:


#7

resolved:

WARN : org.graylog2.indexer.messages.Messages - Failed to index message: index=<k8s_26> id=<54d314c0-058c-11e8-b29c-52540040b828> error=<{“type”:“mapper_parsing_exception”,“reason”:“failed to parse [time]”,“caused_by”:{“type”:“illegal_argument_exception”,“reason”:“Invalid format: “2018-01-12 16:22:00” is malformed at " 16:22:00"”}}>

https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html


(system) #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.