Is it possible to (temporary) disable hundreds of errors from DecodingProcessor

(Lecko) #1


I get hundreds of erros regarding imporperly formatted messages.

Sometimes I would like to see what is happening on the raylog server and because of hundreds of such messages it is hard to find other server logs and I would like to surpress such messages.

Is it possible tii configure something in log4j or other way that would prevent such messages ?
On the source side it is harder to change because it seems part of messages from source are processed OK.

2018-09-04T11:16:41.681+02:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=3c4ccc26-b023-11e8-861a-0010e01fe589, journalOffset=6475103485, codec=gelf, payloadSize=148, timestamp=2018-09-04T09:16:41.681Z, remoteAddress=/} on input <59db5f5eac68b1456ae8c32e>.
2018-09-04T11:16:41.686+02:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=3c4cf321-b023-11e8-861a-0010e01fe589, journalOffset=6475103491, codec=gelf, payloadSize=148, timestamp=2018-09-04T09:16:41.682Z, remoteAddress=/}
java.lang.IllegalArgumentException: GELF message <3c4cf321-b023-11e8-861a-0010e01fe589> (received from <>) has empty mandatory "short_message" field.
        at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage( ~[graylog.jar:?]
        at org.graylog2.inputs.codecs.GelfCodec.decode( ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage( ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent( [graylog.jar:?]
        at [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$ [graylog.jar:?]
        at Source) [?:1.8.0_144]

(Philipp Ruland) #2

Heyo @lecko,

you could define a filter in the log4j config.
See here for more details (I would try the RegexFilter):


(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.