Troubleshooting Indexer Faults

[148]: index [graylog_320], type [message], id [98e00800-83f3-11e7-9789-0050568ffebc], message [MapperParsingException[failed to parse [date]]; nested: IllegalArgumentException[Invalid format: "18/08/2017" is malformed at "/08/2017"];]

2017-08-18T09:59:55.260+01:00 ERROR [GelfCodec] Could not parse JSON, first 400 characters: Udp data
com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'Udp': was expecting ('true', 'false' or 'null')
 at [Source: Udp data; line: 1, column: 4]
        at com.fasterxml.jackson.core.JsonParser._constructError( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken( ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._initForReading( ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose( ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper.readTree( ~[graylog.jar:?]
        at org.graylog2.inputs.codecs.GelfCodec.decode( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent( [graylog.jar:?]
        at [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$ [graylog.jar:?]
        at [?:1.8.0_131]

Hey guys,

Can anyone point me in the direction of understanding where these two errors originate from so I can try to resolve them?

This message simply explains that the date message field doesn’t contain a valid date as expected by the index mapping in Elasticsearch.

You can use an extractor or the processing pipeline to use the correct date format and/or create a custom index mapping for the date field.

Some client sent an invalid GELF message to a GELF TCP or UDP input.

The string

Udp data

simply isn’t valid GELF/JSON.

This is fine, but I don’t know where these messages are coming from, since they’re being dropped I can’t see anything (obvious) that would help me identify them… unless the correct approach is to start turning off collectors until the error goes away?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.