GELF message has empty mandatory "short_message" field

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
In my graylog server log file there are many lines with this error

java.lang.IllegalArgumentException: GELF message (received from X.X.X.X:49027) has empty mandatory “short_message” field.
2024-12-13T07:59:50.825+01:00 ERROR [DecodingProcessor] Unable to decode raw message

2. Describe your environment:

  • OS Information:
    Rocky Linux release 9.4 (Blue Onyx)

  • Package Version:
    graylog-server-6.1.3-1.x86_64

  • Service logs, configurations, and environment variables:
    nxlog configuration.

3. What steps have you already taken to try and solve the problem?

From what I see it is a recurring problem for a long time. I have seen many posts on this forum, but none of them have helped me.

4. How can the community help?
I need to find a good configuration of nxlog to avoid this problem.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

In my graylog 6 environment, I have found a configuration in nxlog that does what I need. Now the logs arrive correctly, but I no longer have entries related to GELF message has empty mandatory “short message” field.

I have changed the Output out.

I hope it works for everyone.

Output out
Module om_udp

Host XXXXXXX

Port 12201

OutputType GELF

Exec
if ($ShortMessage == “”) drop();
/Exec
/Output

Remember to put <> where it belongs. Unfortunately my editor is removing them.

3

This is just dropping messages that may be missing that field for some reason, but you may want that message won’t you?

4

Not in my case and the noise in the graylog log was excessive.

5

I have found this substitution better for me:

if ($raw_event =~ /^\s*$/) drop ();

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.