# Invalid short\_message **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [November 10, 2018, 9:16am UTC](https://community.graylog.org/t/invalid-short-message/7587 "2018-11-10T09:16:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rajatdey1](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@rajatdey1](https://community.graylog.org/u/rajatdey1)\ **Post date:** [November 10, 2018, 9:16am UTC](https://community.graylog.org/t/invalid-short-message/7587/1 "2018-11-10T09:16:14Z")
Help need Graylog error . :- java.lang.IllegalArgumentException: GELF message \<0102ddb4-e4c7-11e8-820c-0021f6f31bc1\> (received from \<192.168.30.90:60419\>) has invalid “short\_message”: at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:249) ~[graylog.jar:?]018-11-10T20:00:00.141+11:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=0102ddb4-e4c7-11e8-820c-0021f6f31bc1, journalOffset=7973685, codec=gelf, payloadSize=284, timestamp=2018-11-10T09:00:00.139Z, remoteAddress=/192.168.30.90:60419} java.lang.IllegalArgumentException: GELF message \<0102ddb4-e4c7-11e8-820c-0021f6f31bc1\> (received from \<192.168.30.90:60419\>) has invalid “short\_message”: at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:249) ~[graylog.jar:?] at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?] at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?] at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?] at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_171] I have created a two JDBC input data feeding from oracle database using logstash and redirecting output to gelf . It was working ealier seems GELF has ben updated to 3.1.17 . and it stopped working . . Graylog version . :- 2.4.5 Elastic search - 5.6.13 Logstash - 5.6.13 Gelf - Latest 3.1.17 . Please help me ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [November 11, 2018, 6:01pm UTC](https://community.graylog.org/t/invalid-short-message/7587/2 "2018-11-11T18:01:35Z")
searching in this community might give you already the solution: > [@Graylog unable to receive message from logstash](https://community.graylog.org/t/graylog-unable-to-receive-message-from-logstash/5986/4): > > Thank you Jan and jochen for replying. Yes, the correct input is GELF UDP. Below is my logstash configurations that make it worked. input { jdbc { jdbc\_driver\_library =\> "/logstash-6.3.0/lib/sqljdbc42.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection\_string =\> "jdbc:sqlserver://XXX:XXX;databaseName=XXX" jdbc\_user =\> "XXX" jdbc\_password =\> "XXX" schedule =\> "\* \* \* \* \*" statement =\> "select xxx from XXX" } } filter { mutate… ---
**Author:** ![rajatdey1](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@rajatdey1](https://community.graylog.org/u/rajatdey1)\ **Post date:** [November 11, 2018, 10:19pm UTC](https://community.graylog.org/t/invalid-short-message/7587/3 "2018-11-11T22:19:10Z")
> [@jan](#): > > > Thank you Jan and jochen for replying. Yes, the correct input is GELF UDP. Below is my logstash configurations that make it worked. input { jdbc { jdbc\_driver\_library =\> “/logstash-6.3.0/lib/sqljdbc42.jar” jdbc\_driver\_class =\> “com.microsoft.sqlserver.jdbc.SQLServerDriver” jdbc\_connection\_string =\> “jdbc:sqlserver://XXX:XXX;databaseName=XXX” jdbc\_user =\> “XXX” jdbc\_password =\> “XXX” schedule =\> “\* \* \* \* \*” statement =\> “select xxx from XXX” } } filter { mutate… Thanks a lot for your reply . However . I still have a problem . , I am rubbing two database for two different entry , please find below . input and output . configuration details . :- input { jdbc { # The path to our downloaded jdbc driver saved mine in /bin, driver ojdbc6.jar also works. #Best location can be /vendor folder jdbc\_driver\_library =\> “/usr/share/logstash/vendor/jar/ojdbc6.jar” # ORACLE Driver Class jdbc\_driver\_class =\> “Java::oracle.jdbc.driver.OracleDriver” # ORACLE jdbc connection string to our database, ORACLE jdbc:oracle:thin:@hostname:PORT/SERVICE jdbc\_connection\_string =\> “jdbc:oracle:thin:@servername:1522/LMST” # The user and password we wish to execute our statement as jdbc\_user =\> “audit\_monitoring” jdbc\_password =\> ""ssssss ``` # our SQL query schedule => "*/15 * * * *" statement => "select DB_USER||':'||USERHOST||':'||SQL_TEXT||':'||OBJECT_NAME audit_message from dba_fga_audit_trail" #optional extras I use type => "Database" tags => ["DB AUDIT", "important_tables"] ``` } } filter { mutate { add\_field =\> { “message” =\> “%{audit\_message}” } add\_field =\> { “host” =\> “LMSBPOTDB-DB–server” } } } output { gelf { host =\> “server” custom\_fields =\> [“environment”, “PROD”, “service”, “rootlm01-logstash”] short\_message =\> “LMST gelf output” } stdout { codec =\> rubydebug } } Another similar ebtry for different database . Thanks Rajat ~ ~ ~ ~ ~ Ab ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [November 12, 2018, 8:44am UTC](https://community.graylog.org/t/invalid-short-message/7587/4 "2018-11-12T08:44:00Z")
if you would format your posting it might happen that someone can help you: [https://community.graylog.org/faq#format-markdown](https://community.graylog.org/faq#format-markdown) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [November 26, 2018, 8:44am UTC](https://community.graylog.org/t/invalid-short-message/7587/5 "2018-11-26T08:44:09Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.