GELF Message validation - error has empty mandatory "short_message" field

Graylog Central (peer support)
,
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

I am using nxlog (community edition) to ship wildfly server.log using extension module xm_gelf. nxlog (CE) is installed on wildfly server. using nxlog im_file module to ship file to gray log server using om_udp module (for udp based).

while all is configured as per the documentation - when i tried to check the log message flowing from nxlog to the graylog server - I got error:

2023-11-17T07:39:17.593Z ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=69cf35f2-851c-11ee-a965-6045bdceaabb, messageQueueId=80, codec=gelf, payloadSize=156, timestamp=2023-11-17T07:39:17.583Z, remoteAddress=/172.16.0.7:57156} on input <6548bbce5342af0149f4a335>.
2023-11-17T07:39:17.593Z ERROR [DecodingProcessor] Error processing message RawMessage{id=69cf35f2-851c-11ee-a965-6045bdceaabb, messageQueueId=80, codec=gelf, payloadSize=156, timestamp=2023-11-17T07:39:17.583Z, remoteAddress=/172.16.0.7:57156}
java.lang.IllegalArgumentException: GELF message <69cf35f2-851c-11ee-a965-6045bdceaabb> (received from <172.16.0.7:57156>) has empty mandatory “short_message” field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:263) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:141) ~[graylog.jar:?]

2. Describe your environment:

  • OS Information:
    everything is running on Linux RHEL 8

  • Package Version:
    Graylog v5.2, Opensearch v2.11, nxlog-ce-3.2.2

  • Service logs, configurations, and environment variables:,

nxlog.conf:

image
image704×667 12.5 KB

Gray log:

image
image1366×611 98.6 KB

3. What steps have you already taken to try and solve the problem?

Graylog conf for udp:

image
image1220×484 32.4 KB

4. How can the community help?

Please advise how to resolve this mandatory field being empty error (without changing application code). If we can add this short_message field seperately in nxlog.conf input field with some string or message about host IP or application region from where log is coming.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hey @devender

Try adding this in Nxlog below OutputType

Exec $ShortMessage = $raw_event;
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.