Internal logs filling after update to 2.3.1

jochen · September 28, 2017, 9:07am

It looks like $raw_event (and then ultimately $short_message) is blank.

Make sure that the short_message (or the message) field always contains some non-blank string.

You can see the validation logic for GELF messages in Graylog 2.3.1 here:

Graylog2/graylog2-server/blob/2.3.1/graylog2-server/src/main/java/org/graylog2/inputs/codecs/GelfCodec.java#L230-L269


private void validateGELFMessage(JsonNode jsonNode, UUID id, ResolvableInetSocketAddress remoteAddress) {
    final String prefix = "GELF message <" + id + "> " + (remoteAddress == null ? "" : "(received from <" + remoteAddress + ">) ");


    final JsonNode hostNode = jsonNode.path("host");
    if (hostNode.isMissingNode()) {
        log.warn(prefix + "is missing mandatory \"host\" field.");
    } else {
        if (!hostNode.isTextual()) {
            throw new IllegalArgumentException(prefix + "has invalid \"host\": " + hostNode.asText());
        }
        if (StringUtils.isBlank(hostNode.asText())) {
            throw new IllegalArgumentException(prefix + "has empty mandatory \"host\" field.");
        }
    }


    final JsonNode shortMessageNode = jsonNode.path("short_message");
    final JsonNode messageNode = jsonNode.path("message");
    if (!shortMessageNode.isMissingNode()) {
        if (!shortMessageNode.isTextual()) {
            throw new IllegalArgumentException(prefix + "has invalid \"short_message\": " + shortMessageNode.asText());

This file has been truncated. show original

Topic		Replies	Views
Has empty mandatory "short_message" field for OVA 2.3.1 Graylog Central (peer support)	2	1621	September 12, 2017
Has empty mandatory "short_message" field Graylog Central (peer support)	4	2223	August 24, 2017
GELF UDP message error after upgrade from 2.2 to 2.3 OVA Graylog Central (peer support)	5	1725	August 30, 2017
GELF message has empty mandatory "short_message" field Graylog Central (peer support)	5	128	December 30, 2024
"short_message" problem Graylog Central (peer support)	2	876	August 21, 2018

Internal logs filling after update to 2.3.1

Related topics