Hi,
when sending some logs on a GELF input get 202 as a return code but then i can’t find the record in Graylog. Are there any characters that make the message invalid?
I am attaching below an example of the message sent and the call we make.
in script call:
curl -X POST -S -d @/run/test/$fname -H “Content-Type: application/json” “http://graylog.local:12210/gelf”
file example:
{
“_Ambiente”: “PRODUZIONE”,
“_Anomalia”: “{FCF83E34-6118-47D7-9B96-B7286AACC30C}{C424A887-A89F-455F-8319-960917152221}Microsoft-Exchange-ManagedAvailabilityMicrosoft-Exchange-ManagedAvailabilityMicrosoft-Exchange-ManagedAvailability/Monitoringexc1”,
“_date_reception”: “1605914687”,
“_df_MsgToBem”: “http://SCOMPROVASERVER.local/OperationsManager/Default.aspx?DisplayMode=Pivot&AlertID={90080b32-3ed6-4ab3-92c7-52c12c6e78f8}”,
“_Dsm_name”: “SCOM-PRODUZIONE”,
“_ECM_ActionList”: “0”,
“_ECM_PreAssociatoTicket”: “0”,
“_In_manutenzione”: “0”,
“_Matricola”: “APPLICAZIONI - DIPARTIMENTALI”,
“_mc_operations”: " ",
“_mc_owner”: “AMAINI”,
“_mc_ueid”: “42995624”,
“_msg”: “EXCHANGE - Exchange Admin Center logon is failing on Mailbox Server EXCPROVAPOSTA. Availability has dropped to 4REPLACE_PERCENT_SIGN. You can find protocol level traces for the failures on C:\Program Files\Microsoft\Exchange Server\V15\Logging\Monitoring\ECP\EacBackEndLogonProbe. Incident start time: 11/20/2020 7:04:22 PM Last failed result: Failing Component - Ecp Failure Reason - PassiveDatabase Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation”,
“_msg_catalog”: “”,
“_Nodo”: “EXCPROVAPOSTA”,
“_Rilevato”: “1605914667”,
“_ServerName”: “EXCPROVAPOSTA”,
“_Severita_corrente”: “Error”,
“_Severity”: “HIGH”,
“_Source”: “SCOM”,
“_Status”: “CLOSED”,
“_Ticket_Num”: “TKINCT0000123”,
“_Tipo_anomalia”: “[ERROR]::Exchange Health Set”,
“_tipo_apparato”: “SERVER”,
“message”: “STATISTICHE”
}
the length of the data field should not be because longer messages are loaded.
The data types are correct, we don’t put string in int or reverse.
how can I do?