Problem with Graylog 4.3.15 in Kubernetes cluster

[ferdagon (Fernando)]

1. Describe your incident:
Good morning, first of all thank you for your help, we are having constant errors in gelf http & TCP type inputs, I leave you a screenshot of the errors.

2. Describe your environment:

• OS Information: Rocky 9.1 with Kubernetes Cluster and Graylog 4.3.15

• Package Version: Graylog 4.3.15

• Service logs, configurations, and environment variables:
  Default

3. What steps have you already taken to try and solve the problem?
Change

Idle writer timeout (optional) to 0

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[Joel_Duffield]

What are you using to ship the logs to this input?

[ferdagon (Fernando)]

Hello!

Nxlog → Haproxy → metalLB → Graylog

Thanks greetings!

[Wine_Merchant]

@ferdagon

What does your NXlog configuration look like and how are the GELF inputs configured?

[ferdagon (Fernando)]

NXLOG

Module im_file File "/var/azure/eventhub/eventhub.log" Exec if $raw_event =~ /^$/ drop(); Exec $agentName = "eventhubagent"; if $raw_event =~ /- - (.*)/ { $short_message= $1; } Module om_ssl Host destination Port 443 CAFile /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt OutputType GELF_TCP Every 30 sec First 2010-12-17 00:19:06 Exec reconnect();

HAPROXY

acl host_azureeventhub443 hdr(host) -i url:443
acl host_azureeventhub443 hdr(host) -i backend
use_backend azureeventhub if host_azureeventhub443

backend azureeventhub
balance roundrobin
option httpclose
option forwardfor
cookie JSESSIONID prefix
option http-keep-alive
timeout http-request 200
timeout http-keep-alive 30
timeout connect 5000
server metallbsoc metallb:15390 check

METALLB

k get services -n logserver | grep 15390
graylog-soc02 LoadBalancer IP POD EXTERNALIP-METALLB 15390:30556/TCP 243d

GRAYLOG

[ferdagon (Fernando)]

Good morning,

Any ideas?

Thanks greetings!

[Wine_Merchant]

Good morning @ferdagon

If you were to attempt to use raw input as opposed to GELF as you then able to ingest logs?