Graylog presents message "has empty mandatory "short_message" field."

Graylog Central (peer support)
1

Good afternoon,
My Graylog has been presenting the message:

“2018-10-05T15:29:35.266-03:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=9c19cc06-c8cc-11e8-a292-005056872dfd, journalOffset=925857011, codec=gelf, payloadSize=149, timestamp=2018-10-05T18:29:35.262Z, remoteAddress=/172.31.15.98:46454} on input <5b911f738e6d340e5725bef1>.
2018-10-05T15:29:35.266-03:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=9c19cc06-c8cc-11e8-a292-005056872dfd, journalOffset=925857011, codec=gelf, payloadSize=149, timestamp=2018-10-05T18:29:35.262Z, remoteAddress=/172.31.15.98:46454}
java.lang.IllegalArgumentException: GELF message <9c19cc06-c8cc-11e8-a292-005056872dfd> (received from <172.31.15.98:46454>) has empty mandatory “short_message” field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]”

I use the version “Graylog 2.4.6+ceaa7e4 on xxxxx (Oracle Corporation 1.8.0_181 on Linux 3.10.0-862.11.6.el7.x86_64)”

Follows configuration of nxlog.conf:
"
Module xm_gelf

Module xm_exec Module im_file File "/app/AAS/logs/AAS.log" Module om_udp Host 172.31.9.21 Port 20200 OutputType GELF_UDP Exec if ($short_message == "") drop(); Exec $raw_event = substr($raw_event, 0, 1000000); "

I tried some solutions presented in the forums, but without success:

(Exec if ($short_message == “”) drop();

Exec $raw_event = substr($raw_event, 0, 1000000);

I will be grateful with the help of you

2

could you please make your post readable (and understandable) by using the formatting options that are given.

https://community.graylog.org/faq

Tank you

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.