"short_message" problem


#1

i have problem
graylog version: 2.4.6
java version:1.8.0_152
problem is :
2018-08-07T16:22:17.265+08:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=fefcfce1-9a1a-11e8-b15a-fa163e5da13d, journalOffset=1210, codec=gelf, payloadSize=351, timestamp=2018-08-07T08:22:17.262Z, remoteAddress=/172.22.25.27:53898}
java.lang.IllegalArgumentException: GELF message (received from <172.22.25.27:53898>) has empty mandatory “short_message” field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_152

[root@tomcat01 ~]# cat /etc/graylog/collector-sidecar/generated/nxlog.conf
define ROOT /usr/bin

Module xm_gelf

User nxlog
Group nxlog

Moduledir /usr/libexec/nxlog/modules
CacheDir /var/spool/collector-sidecar/nxlog
PidFile /var/run/graylog/collector-sidecar/nxlog.pid

define LOGFILE /var/log/graylog/collector-sidecar/nxlog.log
LogFile %LOGFILE%
LogLevel INFO

Module xm_fileop When @daily Exec file_cycle('%LOGFILE%', 7);

<Input 5b693ae7febfbe7ad1709cbb>
Module im_file
File ‘/var/log/tima/catalina.out’
PollInterval 1
SavePos True
ReadFromLast True
Recursive True
RenameCheck False
Exec $FileName = file_name(); # Send file name with each message

<Output 5b693ac1febfbe7ad1709c8f>
Module om_tcp
Host 172.20.224.88
Port 12201
OutputType GELF_TCP
Exec $short_message = $raw_event; # Avoids truncation of the short_message field.
Exec $gl2_source_collector = ‘6cd9019b-7c99-4e7b-a650-20f891c634c7’;
Exec $collector_node_id = ‘172.22.25.27’;
Exec $Hostname = hostname_fqdn();

Path 5b693ae7febfbe7ad1709cbb => 5b693ac1febfbe7ad1709c8f

i try many ways ,but problem is still , please give me some way. thanks before!


(Jan Doberstein) #2

if you try to format your posting: https://community.graylog.org/faq#format-markdown you might get an answer - in addition searching this community board would help you to resolve the issue.