# Problem with Graylog 4.3.15 in Kubernetes cluster

**URL:** <https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630>\
**Category:** Graylog Central (peer support)\
**Tags:** gelf\
**Created:** [February 26, 2024, 8:50am UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630 "2024-02-26T08:50:39Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ferdagon](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@ferdagon](https://community.graylog.org/u/ferdagon)\
**Post date:** [February 26, 2024, 8:50am UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/1 "2024-02-26T08:50:40Z")

</div>

**1. Describe your incident:**  
Good morning, first of all thank you for your help, we are having constant errors in gelf http & TCP type inputs, I leave you a screenshot of the errors.

**2. Describe your environment:**

- OS Information: Rocky 9.1 with Kubernetes Cluster and Graylog 4.3.15

- Package Version: Graylog 4.3.15

- Service logs, configurations, and environment variables:  
Default

**3. What steps have you already taken to try and solve the problem?**  
Change

Idle writer timeout (optional) to 0

**4. How can the community help?**

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/5/55557761de8476a79717f3c07f83e4d168ed498c.png)

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [February 26, 2024, 12:38pm UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/2 "2024-02-26T12:38:53Z")

</div>

What are you using to ship the logs to this input?

---

<div class="post-metadata">

**Author:** ![ferdagon](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@ferdagon](https://community.graylog.org/u/ferdagon)\
**Post date:** [February 26, 2024, 1:03pm UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/3 "2024-02-26T13:03:58Z")

</div>

Hello!

Nxlog → Haproxy → metalLB → Graylog

Thanks greetings!

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [February 26, 2024, 2:53pm UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/4 "2024-02-26T14:53:40Z")

</div>

@ferdagon

What does your NXlog configuration look like and how are the GELF inputs configured?

---

<div class="post-metadata">

**Author:** ![ferdagon](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@ferdagon](https://community.graylog.org/u/ferdagon)\
**Post date:** [February 27, 2024, 9:03am UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/5 "2024-02-27T09:03:15Z")

</div>

NXLOG

 Module im\_file File "/var/azure/eventhub/eventhub.log" Exec if $raw\_event =~ /^$/ drop(); Exec $agentName = "eventhubagent"; if $raw\_event =~ /- - (.\*)/ { $short\_message= $1; } Module om\_ssl Host destination Port 443 CAFile /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt OutputType GELF\_TCP Every 30 sec First 2010-12-17 00:19:06 Exec reconnect(); 

HAPROXY

acl host\_azureeventhub443 hdr(host) -i url:443  
acl host\_azureeventhub443 hdr(host) -i backend  
use\_backend azureeventhub if host\_azureeventhub443

backend azureeventhub  
balance roundrobin  
option httpclose  
option forwardfor  
cookie JSESSIONID prefix  
option http-keep-alive  
timeout http-request 200  
timeout http-keep-alive 30  
timeout connect 5000  
server metallbsoc metallb:15390 check

METALLB

k get services -n logserver | grep 15390  
graylog-soc02 LoadBalancer IP POD EXTERNALIP-METALLB 15390:30556/TCP 243d

GRAYLOG

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/d/5dbee8dcdca8ce0bb125916c862a0a215d9535d5.png)

---

<div class="post-metadata">

**Author:** ![ferdagon](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@ferdagon](https://community.graylog.org/u/ferdagon)\
**Post date:** [March 1, 2024, 7:57am UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/6 "2024-03-01T07:57:38Z")

</div>

Good morning,

Any ideas?

Thanks greetings!

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [March 1, 2024, 8:25am UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/7 "2024-03-01T08:25:29Z")

</div>

Good morning @ferdagon

If you were to attempt to use raw input as opposed to GELF as you then able to ingest logs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 15, 2024, 8:25am UTC](https://community.graylog.org/t/problem-with-graylog-4-3-15-in-kubernetes-cluster/31630/8 "2024-03-15T08:25:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.