Not able to send GELF http message

Graylog Central (peer support)
1

I’m testing out graylog with a docker image (docker linux containers on a Windows computer).
I followed the docker setup from the documentation and I’m simply using the docker compose exemple.
I’m using :
graylog 2.4.0
elasticsearch 5.6.3
mongo 3

I have made an input GELF TCP on the main node (I also tried with Global) with all parameters by default on port 12201 (which is accessible from outside docker) :

bind_address:
0.0.0.0
decompress_size_limit:
8388608
max_message_size:
2097152
override_source:

port:
12201
recv_buffer_size:
1048576
tcp_keepalive:
false
tls_cert_file:

tls_client_auth:
disabled
tls_client_auth_cert_file:

tls_enable:
false
tls_key_file:

tls_key_password:

use_null_delimiter:
true

And then I send a curl message :

curl -X POST -H ‘Content-Type: application/json’ -d ‘{ “version”: “1.1”, “host”: “example.org”, “short_message”: “A short message”, “level”: 5, “_some_info”: “foo” }’ ‘http://localhost:12201/gelf’

All I get is this :

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 112 0 0 100 112 0 9 0:00:12 0:00:11 0:00:01 0

That I can only stop with ctrl+c. I also tried with Postman, I never get a response and I have to cancel the request.

2

When canceling the request I have this appearing in the logs :

2018-03-22 08:47:47,735 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Unable to decode raw message RawMessage{id=b234ff90-2dad-11e8-ad8b-0242ac130004, journalOffset=6, codec=gelf, payloadSize=365, timestamp=2018-03-22T08:47:47.721Z, remoteAddress=/172.19.0.1:39410} on input <5ab295be08813b0001fe49fb>.
2018-03-22 08:47:47,735 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=b234ff90-2dad-11e8-ad8b-0242ac130004, journalOffset=6, codec=gelf, payloadSize=365, timestamp=2018-03-22T08:47:47.721Z, remoteAddress=/172.19.0.1:39410}
com.fasterxml.jackson.core.JsonParseException: Unrecognized token ‘POST’: was expecting (‘true’, ‘false’ or ‘null’)
at [Source: POST /gelf HTTP/1.1
Content-Type: application/json
cache-control: no-cache
Postman-Token: 60f43043-6d8e-4131-b60f-cfbf39f23ca6
User-Agent: PostmanRuntime/7.1.1
Accept: /
Host: 127.0.0.1:12201
accept-encoding: gzip, deflate
content-length: 86
Connection: keep-alive
{“short_message”:“Hello there”, “host”:“example.org”, “facility”:“test”, “_foo”:“bar”}; line: 1, column: 5]
at com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1702) ~[graylog.jar:?]
at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:558) ~[graylog.jar:?]
at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2839) ~[graylog.jar:?]
at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1903) ~[graylog.jar:?]
at com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:749) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3850) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3799) ~[graylog.jar:?]
at com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2397) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:127) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]

3

Maybe you should try a GELF HTTP input. :thinking:

4

Well I pretty much imagined it was probably something stupid like that…
Thank you very much !

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.