When i try to send logs via GELF over HTTPs by curl in a shell. i always got the following response whenever it accepted by graylog or not:
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close
and when it not accepted by graylog, there is no message discarded in the show details of inputs:
is there anyway to tell a POST successful or not on the client side ?
No, that’s currently not possible.
While the HTTP POST request succeeded and the received message was written into the journal, it may fail at a later stage in the processing (e. g. being dropped in a pipeline rule) or fail to index into Elasticsearch. All of that happens much after the client sent the HTTP request.
thanks Jochen,
so for my case, should the Input already got those messages so there is no drops from input drops statistic， and where should i find out the related drops statistic ?
You can find various metrics on the System / Nodes / Metrics page (or via the Graylog REST API) for each Graylog node, for example:
org.graylog2.inputs.codecs.*.failures
org.graylog2.outputs.BlockingBatchedESOutput.*
org.graylog2.outputs.ElasticSearchOutput.*
After i reboot those servers, it is quite strange that there is no messages get in now:
before i send any message to servers the statistic on GELF over HTTPs inputs:
and after i send a message via the following commands:
curl -i -XPOST https://gl3.mylogs.com:12201/gelf -p0 -d'{
"host":"hosts.mylogs.com",
"short_message":"test 1",
"full_message":"this is a test message",
"level":6 }'
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close
curl -i -XPOST https://gl2.mylogs.com:12201/gelf -p0 -d'{
"host":"hosts.mylogs.com",
"short_message":"test 1",
"full_message":"this is a test message",
"level":6 }'
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close
curl -i -XPOST https://gl1.mylogs.com:12201/gelf -p0 -d'{
"host":"hosts.mylogs.com",
"short_message":"test 1",
"full_message":"this is a test message",
"level":6 }'
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close
and the inputs statistic updated as following:
now that it says there is 0 message discarded. let us check the metrics for a node:
so where the system tell those messages goes ?
but it quite strange is that after i using a shell script to keep sending, messages got in ! and then i stop the shell, send message one by one manually, those messages also got in!
It seems there is a buffer on graylog to get filled and then works.
