Graylog error in webportal

sateesh · July 3, 2018, 11:17am

Hi
I am seeing below popuop in graylog portal, even after updaing elastic search java memory facing same issue
Journal utilization is too high (triggered 5 days ago)
Journal utilization is too high and may go over the limit soon. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit. (Node: c74f13a69f9)

Uncommited messages deleted from journal (triggered 5 days ago)
Some messages were deleted from the Graylog journal before they could be written to Elasticsearch. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit. (Node: cd3a69f9)

jochen · July 3, 2018, 11:29am

Check the logs of your Graylog and Elasticsearch nodes.
http://docs.graylog.org/en/2.4/pages/configuration/file_location.html

Also, the notification is 5 days old, so you might as well close it by clicking on the ‘X’ in the upper right corner.

sateesh · July 3, 2018, 12:08pm

Automatically it will clear once it is fixed.

In graylog server i can see the below error.
ERROR [DecodingProcessor] Unable to decode raw message

ERROR [DecodingProcessor] Error processing message RawMessage{id=a70c202aa5f499796, journalOffset=982707249, codec=gelf, payloadSize=214, timestamp=2018-07-03T12:07:27.144Z, remoteAddress=/10.22.1.30:51624}
java.lang.IllegalArgumentException: GELF message (received from <10.22.1.30:51624>) has empty mandatory “short_message” field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThread

mev9669 · July 3, 2018, 1:33pm

Your log record needs a short_message or message field with some value. Depends on how are you feeding the logs to Graylog.

sateesh · July 3, 2018, 4:28pm

short_message or message field with some value what value need to provide here

jochen · July 3, 2018, 4:31pm

Any non-blank string.

github.com

Graylog2/graylog2-server/blob/2.4.5/graylog2-server/src/main/java/org/graylog2/inputs/codecs/GelfCodec.java#L245-L263


final JsonNode shortMessageNode = jsonNode.path("short_message");
final JsonNode messageNode = jsonNode.path("message");
if (!shortMessageNode.isMissingNode()) {
    if (!shortMessageNode.isTextual()) {
        throw new IllegalArgumentException(prefix + "has invalid \"short_message\": " + shortMessageNode.asText());
    }
    if (StringUtils.isBlank(shortMessageNode.asText()) && StringUtils.isBlank(messageNode.asText())) {
        throw new IllegalArgumentException(prefix + "has empty mandatory \"short_message\" field.");
    }
} else if (!messageNode.isMissingNode()) {
    if (!messageNode.isTextual()) {
        throw new IllegalArgumentException(prefix + "has invalid \"message\": " + messageNode.asText());
    }
    if (StringUtils.isBlank(messageNode.asText())) {
        throw new IllegalArgumentException(prefix + "has empty mandatory \"message\" field.");
    }
} else {
    throw new IllegalArgumentException(prefix + "is missing mandatory \"short_message\" or \"message\" field.");
}

system · July 17, 2018, 4:31pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Journal utilization is too high - elasticsearch running Graylog Central (peer support)	7	3087	October 23, 2018
Journal utilization is too high - Uncommited messages deleted from journal Graylog Central (peer support)	4	15595	August 30, 2018
Journal Utilization is too high Graylog Central (peer support)	17	18477	November 20, 2017
Journal Message processing Graylog Central (peer support)	2	936	June 24, 2017
Unprocessed Messages in Journal Graylog Central (peer support)	6	3452	August 24, 2017

Graylog error in webportal

Related topics