# I have 2 issues with GELF HTTP

**URL:** <https://community.graylog.org/t/i-have-2-issues-with-gelf-http/34650>\
**Category:** Graylog Central (peer support)\
**Tags:** gelf\
**Created:** [January 11, 2025, 1:29am UTC](https://community.graylog.org/t/i-have-2-issues-with-gelf-http/34650 "2025-01-11T01:29:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![FingerlessGloves](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/fingerlessgloves/32/17558_2.png) [@FingerlessGloves](https://community.graylog.org/u/FingerlessGloves)\
**Post date:** [January 11, 2025, 1:29am UTC](https://community.graylog.org/t/i-have-2-issues-with-gelf-http/34650/1 "2025-01-11T01:29:59Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**  
I’m wanting to use GELF HTTP to submit JSON messages to Graylog. I am running 6.1. I have added the GELF HTTP input and configured it with TLS and Authorization Header Name with Authorization Header Value.

If I use CURL to send a message, with the wrong Authorization Header Value, the HTTP response is 401 as expected but it still logs that message in Graylog.

Example curl command returns 202 ACCEPTED, but if I add a extra letter to the Authorization it’ll say 401 Unauthorized but still commit the message

```auto
curl -X POST https://hostname:12201/gelf \
-H "Content-Type: application/json" \
-H "Authorization: MySecretToken12345" \
-d '{
  "version": "1.1",
  "host": "myhost",
  "message": "did a thing a",
  "timestamp": '"$(date +%s)"',
  "level": 1
}' -v

```

Also if I tick `Enable Bulk Receiving` no messages get logged.

Example CURL, neither of these work but both return 202 ACCEPTED

```auto
curl -X POST https://localhost:12201/gelf \
-H "Content-Type: application/json" \
-H "Authorization: MySecretToken12345" \
-d '{
  "version": "1.1",
  "host": "myhost",
  "message": "did a thing c",
  "timestamp": '"$(date +%s)"',
  "level": 1
}\n{
  "version": "1.1",
  "host": "myhost",
  "message": "did a thing d",
  "timestamp": '"$(date +%s)"',
  "level": 1
}' -v

curl -X POST https://localhost:12201/gelf \
-H "Content-Type: application/json" \
-H "Authorization: MySecretToken12345" \
-d '{
  "version": "1.1",
  "host": "myhost",
  "message": "did a thing e",
  "timestamp": '"$(date +%s)"',
  "level": 1
}' -v

```

**2. Describe your environment:**

- OS Information: Debian 12

- Package Version: Docker setup so running  
graylog/graylog:6.1 (Graylog 6.1.5+e3ae3ce on graylog-server (Eclipse Adoptium 17.0.13 on Linux 6.1.0-28-amd64))  
graylog-datanode:6.1 (6.1.5+e3ae3ce)  
mongo:5.0

- Service logs, configurations, and environment variables:  
Only just installed as a default installation, only added the GELF INPUT, no extractors or custom streams etc. Wanted to get INPUT working before I continue to customise.

**3. What steps have you already taken to try and solve the problem?**  
Tried different values, with no success. Also double checked the TLS certificate I set is working as expected, encase that was the issue.  
Stopped and Started the INPUT.

**4. How can the community help?**  
I would like to know why auth is not working, so where I’m going wrong and why when bulk is enabled, I can’t send single messages as well.

If GELF not supporting bulk messages with CURL, that’s not a problem. I’m only using it for testing currently, then looking to use [GitHub - kkamkou/node-gelf-pro: Graylog2 client library for Node.js](https://github.com/kkamkou/node-gelf-pro)

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![greendoom](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/greendoom/32/18557_2.png) [@greendoom](https://community.graylog.org/u/greendoom)\
**Post date:** [January 20, 2025, 7:06am UTC](https://community.graylog.org/t/i-have-2-issues-with-gelf-http/34650/2 "2025-01-20T07:06:18Z")

</div>

Hello!

Have the same issue with accepting all messages.  
I use helm [chart](https://github.com/eldada/helm-charts/blob/master/stable/graylog/README.md) for deploy.  
I dont use TLS, I added Authorization Header Name and Value to gelf http input.  
When I send message by curl and use authorization name and value, graylog accept message and return 202 accepted - messages are in graylog. When send without authorization name and value, return 401 Unauthorized but accept message and I see it in graylog also.

---

<div class="post-metadata">

**Author:** ![greendoom](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/greendoom/32/18557_2.png) [@greendoom](https://community.graylog.org/u/greendoom)\
**Post date:** [January 20, 2025, 7:07am UTC](https://community.graylog.org/t/i-have-2-issues-with-gelf-http/34650/3 "2025-01-20T07:07:45Z")

</div>

The same issue to me with Authorization Header Name and Authorization Header Value.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 3, 2025, 7:07am UTC](https://community.graylog.org/t/i-have-2-issues-with-gelf-http/34650/4 "2025-02-03T07:07:53Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.