Has empty mandatory "short_message" field for OVA 2.3.1

Graylog Central (peer support)
1

HI, I’m still getting the following error after upgrading to 2.3.1. Is this filed still a mandatory? i though GELF parser was made less strict?

Current version Graylog 2.3.1+9f2c6ef on localhost (Oracle Corporation 1.8.0_144 on Linux 4.2.0-34-generic)

2017-08-28_21:52:08.77968 java.lang.IllegalArgumentException: GELF message <23a2cb7b-8c3b-11e7-ad75-005056a7396f> (received from <11.11.11.11:4094>) has empty mandatory "short_message" field.
2017-08-28_21:52:08.78106       at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
2017-08-28_21:52:08.78265       at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
2017-08-28_21:52:08.78303       at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?]
2017-08-28_21:52:08.78376       at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?]
2017-08-28_21:52:08.78523       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
2017-08-28_21:52:08.78590       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
2017-08-28_21:52:08.78788       at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
2017-08-28_21:52:08.78865       at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
2017-08-28_21:52:08.79041       at java.lang.Thread.run(Thread.java:748) [?:1.8.0_144]
2

If the GELF payload doesn’t contain a short_message or message field, it’s invalid.

Messages like these were silently dropped before Graylog 2.3.0 and now at least trigger a log entry.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.