Missing messages on graylog

[alexmagh (AM)]

Hi,

1. Describe your incident:

Client send logs with rsyslog to the concentrator. Logs on concentrator and on client are exactly the same. There is no issue between client->server.
However, when i’ll go on graylog, there are missing messages.
For example, this is one message in a log file present on the concentrator:

2023-10-02 10:23:03,951|pool-1-thread-18|INFO |EvaluationServiceByDossierWorker|eval-dossier-312||XXX|2023||eval-dossier-312|Fin evaluation par dossier : 081157518 (en 0.001 s)

This message is also present on graylog:

There are other messages following exactly the same pattern, but they are not present on graylog.

2. Describe your environment:
1 log concentrator: CentOS7
a cluster of 3 graylog server: CentOS7
a cluster of 3 elasticsearch: CentOS7

4. How can the community help?

Has anyone in the community encountered this problem?
Can you give me some research directions?

Thanks,
Regards,

[gsmith]

Hey @alexmagh

Not sure, if the logs are the same format and some are missing using “log concentrator”. Maybe check elasticsearch/opensearch log files. Only time I didnt receive log/s was the Date/Time were incorrect so I didnt see it right away. Or the input was incorrect for the types of logs it was receiving.