Internal logs filling after update to 2.3.1

jochen · September 28, 2017, 9:07am

It looks like $raw_event (and then ultimately $short_message) is blank.

Make sure that the short_message (or the message) field always contains some non-blank string.

You can see the validation logic for GELF messages in Graylog 2.3.1 here:

Graylog2/graylog2-server/blob/2.3.1/graylog2-server/src/main/java/org/graylog2/inputs/codecs/GelfCodec.java#L230-L269


private void validateGELFMessage(JsonNode jsonNode, UUID id, ResolvableInetSocketAddress remoteAddress) {
    final String prefix = "GELF message <" + id + "> " + (remoteAddress == null ? "" : "(received from <" + remoteAddress + ">) ");


    final JsonNode hostNode = jsonNode.path("host");
    if (hostNode.isMissingNode()) {
        log.warn(prefix + "is missing mandatory \"host\" field.");
    } else {
        if (!hostNode.isTextual()) {
            throw new IllegalArgumentException(prefix + "has invalid \"host\": " + hostNode.asText());
        }
        if (StringUtils.isBlank(hostNode.asText())) {
            throw new IllegalArgumentException(prefix + "has empty mandatory \"host\" field.");
        }
    }


    final JsonNode shortMessageNode = jsonNode.path("short_message");
    final JsonNode messageNode = jsonNode.path("message");
    if (!shortMessageNode.isMissingNode()) {
        if (!shortMessageNode.isTextual()) {
            throw new IllegalArgumentException(prefix + "has invalid \"short_message\": " + shortMessageNode.asText());

This file has been truncated. show original

Topic		Replies	Views
Yet another "has empty mandatory "short_message" field" issue Graylog Central (peer support)	2	1693	March 28, 2018
How to trouble shoot GELF message XXXX has empty mandatory "short_message" field Graylog Central (peer support)	3	2185	September 14, 2018
GELF UDP message error after upgrade from 2.2 to 2.3 OVA Graylog Central (peer support)	5	1648	August 30, 2017
GELF multiline messages are filling internal log with errors Graylog Central (peer support) sidecar , nxlog , multi-linenx	1	1211	January 26, 2018
Docker logging and empty mandatory "short_message" field Graylog Central (peer support)	4	2422	April 5, 2019

Internal logs filling after update to 2.3.1

Related Topics