Messages being cut off

[tnacnud1 (Taylor Duncan)]

Good morning. I am running into a strange issue I hope someone has seen before. I am sending in messages to Graylog over Syslog TCP. The messages from my HaProxy server are being truncated at 947 characters exactly. Here is my config for the INPUT:

allow_override_date:
 true
bind_address:
 0.0.0.0
expand_structured_data:
 false
force_rdns:
 false
max_message_size:
 2097152
override_source:
 <empty>
port:
 5555
recv_buffer_size:
 1048576
store_full_message:
 true
tcp_keepalive:
 false
tls_cert_file:
 <empty>
tls_client_auth:
 disabled
tls_client_auth_cert_file:
 <empty>
tls_enable:
 false
tls_key_file:
 
tls_key_password:
 
use_null_delimiter:
 false

What else should I be looking at to see why the messages are being truncated?

[jan (Jan Doberstein)]

Maximum event size by protocol: UDP syslog messages should not exceed 1024 bytes. TCP syslog messages should not exceed 8192 bytes.

I guess your sender does cut the messages at 1024 bytes? overall if you want to send more (like a Java Stacktrace) into Graylog you should not use Syslog. Use GELF, BEATS or even RAW

[tnacnud1 (Taylor Duncan)]

So I traced this back to HaProxy itself. HaProxy has an option to set the log length. The default is 1024. I resolved the issue by adding this line in HaProxy:

log 127.0.0.1 len 65535 local2