# GELF Message validation - error has empty mandatory "short\_message" field

**URL:** <https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723>\
**Category:** Graylog Central (peer support)\
**Tags:** nxlog, gelf\
**Created:** [November 17, 2023, 2:10pm UTC](https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723 "2023-11-17T14:10:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![devender](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/devender/32/15717_2.png) [@devender](https://community.graylog.org/u/devender)\
**Post date:** [November 17, 2023, 2:10pm UTC](https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723/1 "2023-11-17T14:10:10Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**

I am using nxlog (community edition) to ship wildfly server.log using extension module xm\_gelf. nxlog (CE) is installed on wildfly server. using nxlog im\_file module to ship file to gray log server using om\_udp module (for udp based).

while all is configured as per the documentation - when i tried to check the log message flowing from nxlog to the graylog server - I got error:

2023-11-17T07:39:17.593Z ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=69cf35f2-851c-11ee-a965-6045bdceaabb, messageQueueId=80, codec=gelf, payloadSize=156, timestamp=2023-11-17T07:39:17.583Z, remoteAddress=/172.16.0.7:57156} on input \<6548bbce5342af0149f4a335\>.  
2023-11-17T07:39:17.593Z ERROR [DecodingProcessor] Error processing message RawMessage{id=69cf35f2-851c-11ee-a965-6045bdceaabb, messageQueueId=80, codec=gelf, payloadSize=156, timestamp=2023-11-17T07:39:17.583Z, remoteAddress=/172.16.0.7:57156}  
java.lang.IllegalArgumentException: GELF message \<69cf35f2-851c-11ee-a965-6045bdceaabb\> (received from \<172.16.0.7:57156\>) has empty mandatory “short\_message” field.  
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:263) ~[graylog.jar:?]  
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:141) ~[graylog.jar:?]

**2. Describe your environment:**

- OS Information:  
everything is running on Linux RHEL 8

- Package Version:  
Graylog v5.2, Opensearch v2.11, nxlog-ce-3.2.2

- Service logs, configurations, and environment variables:,

nxlog.conf:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d2faa749ebb7e586887f3efff87aaf84619928e4.png)

Gray log:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/1262218719c9f5c9b195f05b4bee8f00199c727b.png)

**3. What steps have you already taken to try and solve the problem?**

Graylog conf for udp:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/89097863650f37afc058d7441a27da99349670f8.png)

**4. How can the community help?**

Please advise how to resolve this mandatory field being empty error (without changing application code). If we can add this short\_message field seperately in nxlog.conf input field with some string or message about host IP or application region from where log is coming.

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [November 21, 2023, 5:29am UTC](https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723/2 "2023-11-21T05:29:08Z")

</div>

Hey @devender

Try adding this in Nxlog below OutputType

```auto
Exec $ShortMessage = $raw_event;

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 5, 2023, 5:30am UTC](https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723/3 "2023-12-05T05:30:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.