Graylog 2.2 update from 2.1: Error processing message RawMessage

[anandharaj]

The issue seems fixed on version 2.2.3 as im able to receive the syslog messages from Cisco devices.

[moseman]

Hi there,

the issue ist still there for Sophos UTM. I´m quite new to graylog and not fit enough yet for extractors etc…

Will there be a solution of the issue?

Thanks an best regards,

Christian

[Mbuyukkarakas (Mehmet Ali Buyukkarakas)]

Hello there,

I have the same problem with Sophos UTM / RED devices.
Will there be a solution of the issue?

Regards

Mehmet

[jan (Jan Doberstein)]

@Mbuyukkarakas

Yes, use a Raw/Plaintext UDP input instead of a Syslog UDP input and add some extractors or use the message processing pipeline to get structured information out of these messages.

[TerryJohnson]

Yes, use a Raw/Plaintext UDP input instead of a Syslog UDP input and add some extractors or use the message processing pipeline to get structured information out of these messages.

Is there a knowledge base article or blog post on how to do this right? For a first time user, immediately getting a flood of date parsing exceptions is puzzling.

For anyone else seeing these parsing errors on a Docker install of Graylog, note that switching to host mode networking will allow you to identify the troublesome log source.