I am sending messages to my graylog cluster using GELF HTTP over port 12229. The client is receiving 202 responses indicating the logs are processed. In the “Input” tab, I’m looking at “Throughput / Metrics” > “Network IO”, and that is filling up as I send messages (I have been sending the example t…

Is the system time still accurate? I’ve experienced issues before where ntpd died and my search results became skewed/nonexistent. The data was being filed away routinely in elasticsearch, but a search using the browser couldn’t retrieve the proper time range.

Yeah, the system time seems to be accurate within 1 minute. I should have said, I have a few other inputs that work just fine with indexing / searching. It is just the new GELF HTTP input that isn’t working properly.

[image] wellsjo: The client is receiving 202 responses indicating the logs are processed. The GELF HTTP input pretty much always responds with HTTP status 202. It doesn’t mean that the messages were valid and were processed. GELF HTTP input accepts invalid G…

hi, you could look at the logs of graylog server. The could be some java exceptions that help to understand. Very often the timestamp field has a space between date and time, and Graylog requires it to be the letter T instead. You can see if this is the case By looking at the logs. If it is, yo…

I see…dang, that’s misleading. I’m sending the example payload to my server: curl -XPOST http://graylog.example.org:12202/gelf -p0 -d '{"short_message":"Hello there", "host":"example.org", "facility":"test", "_foo":"bar"}'

You said you’ve started the GELF HTTP input on port 12229, but that cURL command is sending the payload to port 12202.

yeah, sorry, that’s because I copied it directly from the docs. in my tests I’m using the correct host/port. As I said before, it’s hitting the server, which is filling up the input and returning a 202, I just can’t see any messages.

I am finally able to see messages using curl…not sure what changed. I’m going to do some investigating and will report back.

I had this same issue, but I think mine was more to do with sending incorrectly formatted logs through the TCP syslog. Once I sent in through TCP plaintext, it worked fine.

Hey, seems I currently having the same problem, I tried via UDP, TCP and HTTP nothing is working however I can see, as soon as I start sending messages, the Network IO und MSG/s is increasing… However no Messages are shown? Any Idea? This is the curl command: curl -v -XPOST http://192.168.0.50:302…

Graylog processes messages, but I can't see them

Graylog Central (peer support)

aaronsachs (Aaron Sachs) April 1, 2021, 8:14pm 12

Hi there, this topic is 4 years old–can you start a new post please and include the information mentioned in the Community Guidelines https://community.graylog.org/t/faq-guidelines/5?

Topic		Replies	Views
GELF HTTP does not process messages Graylog Central (peer support)	7	1541	November 29, 2018
Delay while getting log via gelf http Graylog Central (peer support) gelf	2	164	March 1, 2024
Sending GELF via HTTP - error "is missing mandatory . . . field" Graylog Central (peer support)	26	6625	January 17, 2019
Graylog input showing no incoming messages Graylog Central (peer support) pipeline-rules , route-to-streampl	4	9316	September 5, 2017
Inputs - Empty reply Graylog Central (peer support)	6	2310	April 22, 2019

Graylog processes messages, but I can't see them

Related topics