# Gelf-input drop data which include "time" field

**URL:** <https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897>\
**Category:** Graylog Central (peer support)\
**Created:** [January 23, 2018, 9:12am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897 "2018-01-23T09:12:16Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![taideng](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/taideng/32/1631_2.png) [@taideng](https://community.graylog.org/u/taideng)\
**Post date:** [January 23, 2018, 9:12am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/1 "2018-01-23T09:12:16Z")

</div>

if there was a “time” field in my log ,i will not able to see them in graylog…

successed:

```auto
echo '{"version": "1.1","atime":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog-server 9999

```

failed:

```auto
echo '{"version": "1.1","time":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog-server 9999

```

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [January 23, 2018, 9:30am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/2 "2018-01-23T09:30:07Z")

</div>

What type of input have you created in Graylog and what’s its complete configuration?  
Are you using any extractors or pipeline rules in your Graylog cluster (for that input)?

---

<div class="post-metadata">

**Author:** ![taideng](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/taideng/32/1631_2.png) [@taideng](https://community.graylog.org/u/taideng)\
**Post date:** [January 25, 2018, 7:15am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/3 "2018-01-25T07:15:19Z")

</div>

gelf-udp  
bind\_address: 0.0.0.0  
decompress\_size\_limit: 8388608  
override\_source:   
port: 9991  
recv\_buffer\_size: 262144

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [January 25, 2018, 8:21am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/4 "2018-01-25T08:21:31Z")

</div>

Please answer all questions.

Also, you’re using port 9999/udp in your first post but 9991/udp in your second post.

---

<div class="post-metadata">

**Author:** ![taideng](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/taideng/32/1631_2.png) [@taideng](https://community.graylog.org/u/taideng)\
**Post date:** [January 25, 2018, 8:31am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/5 "2018-01-25T08:31:09Z")

</div>

Sorry,i typed wrong port number,it’s 9991,and there is No extractors or pipeline rules used for the input…

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [January 25, 2018, 8:47am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/6 "2018-01-25T08:47:47Z")

</div>

I’ve tried to reproduce your problem, but everything works as it should (GELF UDP input on port 12201/udp, no extractors, no pipeline rules).

```nohighlight
echo '{"version": "1.1","atime":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog.example.org 12201

```

Result:  
 ![Message with field](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7de517e1667f490eacd9c36dfeb80b943a9b6abc.png)

```nohighlight
echo '{"version": "1.1","time":"2018-01-12 16:22:00 ","short_message":"with_time","full_message":"Backtrace here\n\nmore stuff"}' |nc -w1 -u graylog.example.org 12201

```

Result:  
 ![Message with field](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4e5e848dc7287287d29a1af668b35c8d263b57e9.png)

---

<div class="post-metadata">

**Author:** ![taideng](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/taideng/32/1631_2.png) [@taideng](https://community.graylog.org/u/taideng)\
**Post date:** [January 30, 2018, 9:39am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/7 "2018-01-30T09:39:39Z")

</div>

resolved:

WARN : org.graylog2.indexer.messages.Messages - Failed to index message: index=\<k8s\_26\> id=\<54d314c0-058c-11e8-b29c-52540040b828\> error=\<{“type”:“mapper\_parsing\_exception”,“reason”:“failed to parse [time]”,“caused\_by”:{“type”:“illegal\_argument\_exception”,“reason”:“Invalid format: “2018-01-12 16:22:00” is malformed at " 16:22:00"”}}\>

[https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 13, 2018, 9:39am UTC](https://community.graylog.org/t/gelf-input-drop-data-which-include-time-field/3897/8 "2018-02-13T09:39:43Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.