Null number field causes record ingestion failure with GELF TCP Input

Hello @altink:

Is the issue that the message is not ingested by Graylog (you receive some error) or that it fails elasticsearch indexing? Do you see index failures occurring related to these messages? I don’t believe Graylog GELF input should have any issue parsing the field, so I suspect it is elasticsearch but we should verify.

My suspicion is that for the message to be indexed successfully you need to provide a literal null value for the field, which for this type should be

"_field_number":null,

edit: alternatively, simply omit the field entirely when it is null if possible

2 Likes