Graylog error in webportal


(sateesh) #1

Hi
I am seeing below popuop in graylog portal, even after updaing elastic search java memory facing same issue
Journal utilization is too high (triggered 5 days ago)
Journal utilization is too high and may go over the limit soon. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit. (Node: c74f13a69f9)

Uncommited messages deleted from journal (triggered 5 days ago)
Some messages were deleted from the Graylog journal before they could be written to Elasticsearch. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit. (Node: cd3a69f9)


(Jochen) #2

Check the logs of your Graylog and Elasticsearch nodes.
:arrow_right: http://docs.graylog.org/en/2.4/pages/configuration/file_location.html

Also, the notification is 5 days old, so you might as well close it by clicking on the ‘X’ in the upper right corner.


(sateesh) #3

Automatically it will clear once it is fixed.

In graylog server i can see the below error.
ERROR [DecodingProcessor] Unable to decode raw message

ERROR [DecodingProcessor] Error processing message RawMessage{id=a70c202aa5f499796, journalOffset=982707249, codec=gelf, payloadSize=214, timestamp=2018-07-03T12:07:27.144Z, remoteAddress=/10.22.1.30:51624}
java.lang.IllegalArgumentException: GELF message (received from <10.22.1.30:51624>) has empty mandatory “short_message” field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThread


(M D) #4

Your log record needs a short_message or message field with some value. Depends on how are you feeding the logs to Graylog.


(sateesh) #5

short_message or message field with some value what value need to provide here


(Jochen) #6

Any non-blank string.


(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.