Invalid short_message


(Rajat Dey) #1

Help need Graylog error . :-
java.lang.IllegalArgumentException: GELF message <0102ddb4-e4c7-11e8-820c-0021f6f31bc1> (received from <192.168.30.90:60419>) has invalid “short_message”:
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:249) ~[graylog.jar:?]018-11-10T20:00:00.141+11:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=0102ddb4-e4c7-11e8-820c-0021f6f31bc1, journalOffset=7973685, codec=gelf, payloadSize=284, timestamp=2018-11-10T09:00:00.139Z, remoteAddress=/192.168.30.90:60419}
java.lang.IllegalArgumentException: GELF message <0102ddb4-e4c7-11e8-820c-0021f6f31bc1> (received from <192.168.30.90:60419>) has invalid “short_message”:
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:249) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]

I have created a two JDBC input data feeding from oracle database using logstash and redirecting output to gelf . It was working ealier seems GELF has ben updated to 3.1.17 . and it stopped working . .

Graylog version . :- 2.4.5
Elastic search - 5.6.13
Logstash - 5.6.13
Gelf - Latest 3.1.17 .

Please help me


(Jan Doberstein) #2

searching in this community might give you already the solution:


(Rajat Dey) #3

Thanks a lot for your reply . However . I still have a problem . , I am rubbing two database for two different entry , please find below . input and output . configuration details . :-
input {
jdbc {
# The path to our downloaded jdbc driver saved mine in /bin, driver ojdbc6.jar also works.
#Best location can be /vendor folder
jdbc_driver_library => “/usr/share/logstash/vendor/jar/ojdbc6.jar”
# ORACLE Driver Class
jdbc_driver_class => “Java::oracle.jdbc.driver.OracleDriver”
# ORACLE jdbc connection string to our database, ORACLE jdbc:oracle:thin:@hostname:PORT/SERVICE
jdbc_connection_string => “jdbc:oracle:thin:@servername:1522/LMST”
# The user and password we wish to execute our statement as
jdbc_user => “audit_monitoring”
jdbc_password => ""ssssss

# our SQL query
schedule => "*/15 * * * *"
statement => "select DB_USER||':'||USERHOST||':'||SQL_TEXT||':'||OBJECT_NAME audit_message from dba_fga_audit_trail"

#optional extras I use
  type => "Database"
  tags => ["DB AUDIT", "important_tables"]

}
}

filter {
mutate {
add_field => { “message” => “%{audit_message}” }
add_field => { “host” => “LMSBPOTDB-DB–server” }
}
}

output {
gelf {
host => “server”
custom_fields => [“environment”, “PROD”, “service”, “rootlm01-logstash”]
short_message => “LMST gelf output”
}
stdout { codec => rubydebug }
}
Another similar ebtry for different database . Thanks Rajat
~
~
~
~
~

Ab


(Jan Doberstein) #4

if you would format your posting it might happen that someone can help you: https://community.graylog.org/faq#format-markdown