Is it possible to (temporary) disable hundreds of errors from DecodingProcessor


(Lecko) #1

Hello,

I get hundreds of erros regarding imporperly formatted messages.

Sometimes I would like to see what is happening on the raylog server and because of hundreds of such messages it is hard to find other server logs and I would like to surpress such messages.

Is it possible tii configure something in log4j or other way that would prevent such messages ?
On the source side it is harder to change because it seems part of messages from source are processed OK.

2018-09-04T11:16:41.681+02:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=3c4ccc26-b023-11e8-861a-0010e01fe589, journalOffset=6475103485, codec=gelf, payloadSize=148, timestamp=2018-09-04T09:16:41.681Z, remoteAddress=/10.68.27.212:50052} on input <59db5f5eac68b1456ae8c32e>.
2018-09-04T11:16:41.686+02:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=3c4cf321-b023-11e8-861a-0010e01fe589, journalOffset=6475103491, codec=gelf, payloadSize=148, timestamp=2018-09-04T09:16:41.682Z, remoteAddress=/10.68.27.212:50052}
java.lang.IllegalArgumentException: GELF message <3c4cf321-b023-11e8-861a-0010e01fe589> (received from <10.68.27.212:50052>) has empty mandatory "short_message" field.
        at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
        at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
        at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
        at java.lang.Thread.run(Unknown Source) [?:1.8.0_144]

(Philipp Ruland) #2

Heyo @lecko,

you could define a filter in the log4j config.
See here for more details (I would try the RegexFilter):
https://logging.apache.org/log4j/2.0/manual/filters.html

Greetings,
Philipp


(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.