How to tell if the message was dropped or not on clients side with GELF over HTTPs?


(Charles Deng) #1

When i try to send logs via GELF over HTTPs by curl in a shell. i always got the following response whenever it accepted by graylog or not:

HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close

and when it not accepted by graylog, there is no message discarded in the show details of inputs:

is there anyway to tell a POST successful or not on the client side ?


(Jochen) #2

No, that’s currently not possible.

While the HTTP POST request succeeded and the received message was written into the journal, it may fail at a later stage in the processing (e. g. being dropped in a pipeline rule) or fail to index into Elasticsearch. All of that happens much after the client sent the HTTP request.


(Charles Deng) #3

thanks Jochen,

so for my case, should the Input already got those messages so there is no drops from input drops statistic, and where should i find out the related drops statistic ?


(Jochen) #4

You can find various metrics on the System / Nodes / Metrics page (or via the Graylog REST API) for each Graylog node, for example:

org.graylog2.inputs.codecs.*.failures
org.graylog2.outputs.BlockingBatchedESOutput.*
org.graylog2.outputs.ElasticSearchOutput.*


(Charles Deng) #5

After i reboot those servers, it is quite strange that there is no messages get in now:

before i send any message to servers the statistic on GELF over HTTPs inputs:

and after i send a message via the following commands:

curl -i -XPOST https://gl3.mylogs.com:12201/gelf -p0 -d'{
"host":"hosts.mylogs.com",
"short_message":"test 1",
"full_message":"this is a test message",
"level":6 }'
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close

curl -i -XPOST https://gl2.mylogs.com:12201/gelf -p0 -d'{
"host":"hosts.mylogs.com",
"short_message":"test 1",
"full_message":"this is a test message",
"level":6 }'
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close

curl -i -XPOST https://gl1.mylogs.com:12201/gelf -p0 -d'{
"host":"hosts.mylogs.com",
"short_message":"test 1",
"full_message":"this is a test message",
"level":6 }'
HTTP/1.0 202 Accepted
Content-Length: 0
Connection: close

and the inputs statistic updated as following:

now that it says there is 0 message discarded. let us check the metrics for a node:


and

image
image

so where the system tell those messages goes ?


(Charles Deng) #6

but it quite strange is that after i using a shell script to keep sending, messages got in ! and then i stop the shell, send message one by one manually, those messages also got in!

It seems there is a buffer on graylog to get filled and then works.


(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.