Graylog/logstash missing logs: Trouble sending GELF event short_message missing

in the past 2 weeks I’m getting more and more GELF protocol errors in the logstash log and therefore missing logs in Graylog. I’m getting the error from logstash running in docker container and from vms.

Graylog version: 3.1.4
Logstash version: 6.4.3 (tested also 7.5.1, same problem)

logstash output config:
output {
gelf {
host => “…”
port => “12201”
protocol => “TCP”

Error message:
[2020-11-09T08:00:25,432][WARN ][logstash.outputs.gelf ] Trouble sending GELF event {:gelf_event=>{“short_message”=>"", “full_message”=>"", “host”=>“3188ed21bf2a”, “_logType”=>“APP”, “_logLevel”=>“ERROR”, “_thread”=>“ThreadPoolTaskExecutor-138”, “_type”=>“applog-oneview-r2”, “_dateTime”=>“2020-11-09T08:00:24,414+0000”, “_sourceApplication_originatingAppCode”=>"", “_sourceApplication_componentDisplayName”=>"${ctx:applicationName}", “_sourceApplication_appCode”=>“CS_APPS”, “_sourceApplication_appDisplayName”=>“xxxx”, “_sourceApplication_componentCode”=>“xxxx”, “_messageId”=>“d651008986e2740b”, “_hostNameDockerVM”=>“xxxx”, “_method”=>"", “_parent”=>“fc28868db66aa8dd”, “_path”=>"/data/logs/appLog-R2-oneview-reporting.log", “_hostName”=>“3788bdcc4f86”, “_logTag”=>"", “_class”=>“xxxx”, “_user_userId”=>"", “_user_emailId”=>"", “_user_displayName”=>"", “_user_organizationId”=>"", “_user_locale”=>"", “_user_timezone”=>"", “_user_organizationName”=>"", “_stackTrace”=>"", “_source_env”=>“dev”, “_transactionId”=>"", “level”=>6}, :event=>#LogStash::Event:0x6d1b100d, :error=>#<ArgumentError: short_message is missing. Options version, short_message and host must be set.>}

I don’t know why short_message and host are missing. Both should be added by the gelf output automatically.

Any idea whats going on here?

Let me know if you need more information.

Kind Regards

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.