Ingest error without errore code

when sending some logs on a GELF input get 202 as a return code but then i can’t find the record in Graylog. Are there any characters that make the message invalid?
I am attaching below an example of the message sent and the call we make.

in script call:
curl -X POST -S -d @/run/test/$fname -H “Content-Type: application/json” “http://graylog.local:12210/gelf

file example:
“_Ambiente”: “PRODUZIONE”,
“_Anomalia”: “{FCF83E34-6118-47D7-9B96-B7286AACC30C}{C424A887-A89F-455F-8319-960917152221}Microsoft-Exchange-ManagedAvailabilityMicrosoft-Exchange-ManagedAvailabilityMicrosoft-Exchange-ManagedAvailability/Monitoringexc1”,
“_date_reception”: “1605914687”,
“_df_MsgToBem”: “http://SCOMPROVASERVER.local/OperationsManager/Default.aspx?DisplayMode=Pivot&AlertID={90080b32-3ed6-4ab3-92c7-52c12c6e78f8}”,
“_Dsm_name”: “SCOM-PRODUZIONE”,
“_ECM_ActionList”: “0”,
“_ECM_PreAssociatoTicket”: “0”,
“_In_manutenzione”: “0”,
“_mc_operations”: " ",
“_mc_owner”: “AMAINI”,
“_mc_ueid”: “42995624”,
“_msg”: “EXCHANGE - Exchange Admin Center logon is failing on Mailbox Server EXCPROVAPOSTA. Availability has dropped to 4REPLACE_PERCENT_SIGN. You can find protocol level traces for the failures on C:\Program Files\Microsoft\Exchange Server\V15\Logging\Monitoring\ECP\EacBackEndLogonProbe. Incident start time: 11/20/2020 7:04:22 PM Last failed result: Failing Component - Ecp Failure Reason - PassiveDatabase Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation”,
“_msg_catalog”: “”,
“_Rilevato”: “1605914667”,
“_ServerName”: “EXCPROVAPOSTA”,
“_Severita_corrente”: “Error”,
“_Severity”: “HIGH”,
“_Source”: “SCOM”,
“_Status”: “CLOSED”,
“_Ticket_Num”: “TKINCT0000123”,
“_Tipo_anomalia”: “[ERROR]::Exchange Health Set”,
“_tipo_apparato”: “SERVER”,
“message”: “STATISTICHE”

the length of the data field should not be because longer messages are loaded.
The data types are correct, we don’t put string in int or reverse.

how can I do?

we also tried to increase the buffer size on the graylog hostsbut we can’t solve the problem.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.