Troubleshooting Indexer Faults

(Philip Widdowson) #1
[148]: index [graylog_320], type [message], id [98e00800-83f3-11e7-9789-0050568ffebc], message [MapperParsingException[failed to parse [date]]; nested: IllegalArgumentException[Invalid format: "18/08/2017" is malformed at "/08/2017"];]

2017-08-18T09:59:55.260+01:00 ERROR [GelfCodec] Could not parse JSON, first 400 characters: Udp data
com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'Udp': was expecting ('true', 'false' or 'null')
 at [Source: Udp data; line: 1, column: 4]
        at com.fasterxml.jackson.core.JsonParser._constructError( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue( ~[graylog.jar:?]
        at com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken( ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._initForReading( ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose( ~[graylog.jar:?]
        at com.fasterxml.jackson.databind.ObjectMapper.readTree( ~[graylog.jar:?]
        at org.graylog2.inputs.codecs.GelfCodec.decode( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent( [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent( [graylog.jar:?]
        at [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$ [graylog.jar:?]
        at [?:1.8.0_131]

Hey guys,

Can anyone point me in the direction of understanding where these two errors originate from so I can try to resolve them?

(Jochen) #2

This message simply explains that the date message field doesn’t contain a valid date as expected by the index mapping in Elasticsearch.

You can use an extractor or the processing pipeline to use the correct date format and/or create a custom index mapping for the date field.

Some client sent an invalid GELF message to a GELF TCP or UDP input.

The string

Udp data

simply isn’t valid GELF/JSON.

(Philip Widdowson) #3

This is fine, but I don’t know where these messages are coming from, since they’re being dropped I can’t see anything (obvious) that would help me identify them… unless the correct approach is to start turning off collectors until the error goes away?

(system) closed #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.