Problem with Graylog 4.3.15 in Kubernetes cluster

1. Describe your incident:
Good morning, first of all thank you for your help, we are having constant errors in gelf http & TCP type inputs, I leave you a screenshot of the errors.

2. Describe your environment:

  • OS Information: Rocky 9.1 with Kubernetes Cluster and Graylog 4.3.15

  • Package Version: Graylog 4.3.15

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

Idle writer timeout (optional) to 0

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

What are you using to ship the logs to this input?


Nxlog → Haproxy → metalLB → Graylog

Thanks greetings!


What does your NXlog configuration look like and how are the GELF inputs configured?


Module im_file File "/var/azure/eventhub/eventhub.log" Exec if $raw_event =~ /^$/ drop(); Exec $agentName = "eventhubagent"; if $raw_event =~ /- - (.*)/ { $short_message= $1; } Module om_ssl Host destination Port 443 CAFile /etc/pki/ca-trust/extracted/openssl/ OutputType GELF_TCP Every 30 sec First 2010-12-17 00:19:06 Exec reconnect();


acl host_azureeventhub443 hdr(host) -i url:443
acl host_azureeventhub443 hdr(host) -i backend
use_backend azureeventhub if host_azureeventhub443

backend azureeventhub
balance roundrobin
option httpclose
option forwardfor
cookie JSESSIONID prefix
option http-keep-alive
timeout http-request 200
timeout http-keep-alive 30
timeout connect 5000
server metallbsoc metallb:15390 check


k get services -n logserver | grep 15390
graylog-soc02 LoadBalancer IP POD EXTERNALIP-METALLB 15390:30556/TCP 243d



Good morning,

Any ideas?

Thanks greetings!

Good morning @ferdagon

If you were to attempt to use raw input as opposed to GELF as you then able to ingest logs?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.