Invalid short_message

[rajatdey1 (Rajat Dey)]

Help need Graylog error . :-
java.lang.IllegalArgumentException: GELF message <0102ddb4-e4c7-11e8-820c-0021f6f31bc1> (received from <192.168.30.90:60419>) has invalid “short_message”:
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:249) ~[graylog.jar:?]018-11-10T20:00:00.141+11:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=0102ddb4-e4c7-11e8-820c-0021f6f31bc1, journalOffset=7973685, codec=gelf, payloadSize=284, timestamp=2018-11-10T09:00:00.139Z, remoteAddress=/192.168.30.90:60419}
java.lang.IllegalArgumentException: GELF message <0102ddb4-e4c7-11e8-820c-0021f6f31bc1> (received from <192.168.30.90:60419>) has invalid “short_message”:
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:249) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]

I have created a two JDBC input data feeding from oracle database using logstash and redirecting output to gelf . It was working ealier seems GELF has ben updated to 3.1.17 . and it stopped working . .

Graylog version . :- 2.4.5
Elastic search - 5.6.13
Logstash - 5.6.13
Gelf - Latest 3.1.17 .

Please help me

[jan (Jan Doberstein)]

searching in this community might give you already the solution:

Graylog unable to receive message from logstash

Thank you Jan and jochen for replying. Yes, the correct input is GELF UDP. Below is my logstash configurations that make it worked. input { jdbc { jdbc_driver_library => "/logstash-6.3.0/lib/sqljdbc42.jar" jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc_connection_string => "jdbc:sqlserver://XXX:XXX;databaseName=XXX" jdbc_user => "XXX" jdbc_password => "XXX" schedule => "* * * * *" statement => "select xxx from XXX" } } filter { mutate…

[rajatdey1 (Rajat Dey)]

@jan

Thank you Jan and jochen for replying. Yes, the correct input is GELF UDP. Below is my logstash configurations that make it worked. input { jdbc { jdbc_driver_library => “/logstash-6.3.0/lib/sqljdbc42.jar” jdbc_driver_class => “com.microsoft.sqlserver.jdbc.SQLServerDriver” jdbc_connection_string => “jdbc:sqlserver://XXX:XXX;databaseName=XXX” jdbc_user => “XXX” jdbc_password => “XXX” schedule => “* * * * *” statement => “select xxx from XXX” } } filter { mutate…

Thanks a lot for your reply . However . I still have a problem . , I am rubbing two database for two different entry , please find below . input and output . configuration details . :-
input {
jdbc {
# The path to our downloaded jdbc driver saved mine in /bin, driver ojdbc6.jar also works.
#Best location can be /vendor folder
jdbc_driver_library => “/usr/share/logstash/vendor/jar/ojdbc6.jar”
# ORACLE Driver Class
jdbc_driver_class => “Java::oracle.jdbc.driver.OracleDriver”
# ORACLE jdbc connection string to our database, ORACLE jdbc:oracle:thin:@hostname:PORT/SERVICE
jdbc_connection_string => “jdbc:oracle:thin:@servername:1522/LMST”
# The user and password we wish to execute our statement as
jdbc_user => “audit_monitoring”
jdbc_password => ""ssssss

# our SQL query
schedule => "*/15 * * * *"
statement => "select DB_USER||':'||USERHOST||':'||SQL_TEXT||':'||OBJECT_NAME audit_message from dba_fga_audit_trail"

#optional extras I use
  type => "Database"
  tags => ["DB AUDIT", "important_tables"]

}
}

filter {
mutate {
add_field => { “message” => “%{audit_message}” }
add_field => { “host” => “LMSBPOTDB-DB–server” }
}
}

output {
gelf {
host => “server”
custom_fields => [“environment”, “PROD”, “service”, “rootlm01-logstash”]
short_message => “LMST gelf output”
}
stdout { codec => rubydebug }
}
Another similar ebtry for different database . Thanks Rajat
~
~
~
~
~

Ab

[jan (Jan Doberstein)]

if you would format your posting it might happen that someone can help you: https://community.graylog.org/faq#format-markdown