# Unexpected end-of-input - size limit?

**URL:** <https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494>\
**Category:** Graylog Central (peer support)\
**Created:** [September 18, 2017, 2:34pm UTC](https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494 "2017-09-18T14:34:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![juemue](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@juemue](https://community.graylog.org/u/juemue)\
**Post date:** [September 18, 2017, 2:34pm UTC](https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494/1 "2017-09-18T14:34:37Z")

</div>

Hi,

we send our apache accesslogs with our own logformat in GELF to graylog, e.g.

LogFormat “{ “version”: “1.1”,  
“host”: “%h”,  
”\_GEOIP\_COUNTRY\_CODE": " %{GEOIP\_COUNTRY\_CODE}e",\

…

“short\_message”: “%r” }" extended\_gelf

Sometimes graylog can’t parse the shortmessage with an Unexpected end-of-input:

com.fasterxml.jackson.core.JsonParseException: Unexpected end-of-input: was expecting closing quote for a string value

The error always occurs at column 4097. Is there a size limit of 4096 characters for GELF / JSON here ?

Thanks  
Jürgen

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [September 18, 2017, 3:01pm UTC](https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494/2 "2017-09-18T15:01:19Z")

</div>

What’s the exact `LogFormat` configuration of your Apache httpd?  
How are you shipping these manually built GELF messages to Graylog?  
How did you take care of properly escaping the variable values (e. g. `%r`)?

Also take a look at

> **[graylog-labs/apache-mod\_log\_gelf](https://github.com/graylog-labs/apache-mod_log_gelf)**
>
> Apache2 module for writing access logs to Graylog. Contribute to graylog-labs/apache-mod\_log\_gelf development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![juemue](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@juemue](https://community.graylog.org/u/juemue)\
**Post date:** [September 18, 2017, 3:42pm UTC](https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494/3 "2017-09-18T15:42:05Z")

</div>

Hi Jochen,

We can’t use the mod\_log\_gelf because it use mpm\_prefork ☹

The complete LogFormat directive is

```auto
#extended_gelf für Graylog
LogFormat "{ \"version\": \"1.1\",\
 \"host\": \"%h\",\
 \"_GEOIP_COUNTRY_CODE\": \" %{GEOIP_COUNTRY_CODE}e\",\
 \"_User\": \"%u\",\
 \"timestamp\": %{%s}t,\
 \"_Status\": \"%>s\",\
 \"_user_agent\": \"%{User-Agent}i\",\
 \"_X-Forwarded-For\": \"%{X-Forwarded-For}i\",\
 \"_ServerName\": \"%v\",\
 \"_Local_IP-address\": \"%A\",\
 \"_Port\": \"%p\",\
 \"_Response-Handler\": \"%R\",\
 \"_BALANCER_WORKER_ROUTE\": \"%{BALANCER_WORKER_ROUTE}e\",\
 \"_Connection_status\": \"%X\",\
 \"_Cookie\":\"%{cookie}n\",\
 \"_UNIQUE_ID\": \"%{UNIQUE_ID}e\",\
 \"_SSL_PROTOCOL\": \"%{SSL_PROTOCOL}x\",\
 \"_SSL_CIPHER\": \"%{SSL_CIPHER}x\",\
 \"_Bytes_received\": \"%I\",\
 \"_Bytes_send\": \"%O\",\
 \"_ratio\": \"(%{ratio}n%%)\",\
 \"_Request_time\": \"%D\",\
 \"_ModSecTimeIn\": \"%{ModSecTimeIn}e\",\
 \"_ApplicationTime\": \"%{ApplicationTime}e\",\
 \"_ModSecTimeOut\": \"%{ModSecTimeOut}e\",\
 \"_ModSecAnomalyScoreIn\": \"%{ModSecAnomalyScoreIn}e\",\
 \"_ModSecAnomalyScoreOut\": \"%{ModSecAnomalyScoreOut}e\",\
 \"short_message\": \"%r\" }" extended_gelf

```

Shipping per Apache:

```auto
CustomLog "|/bin/nc -u XXX.XXXX.de 9333" extended_gelf

```

If there was a problem with the escaping, there would be other error messages, too.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [September 18, 2017, 3:44pm UTC](https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494/4 "2017-09-18T15:44:20Z")

</div>

> [@juemue](#):
>
> ```auto
> CustomLog "|/bin/nc -u XXX.XXXX.de 9333" extended_gelf
> 
> ```

You’re using UDP which, depending on the underlying network, might have a restriction in packet size.  
Try using TCP.

FWIW, Graylog itself doesn’t have a size restriction for GELF messages and Elasticsearch happily ingests message _fields_ up to 32 KB each.

The problem with unescaped variable values remains.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 2, 2017, 3:44pm UTC](https://community.graylog.org/t/unexpected-end-of-input-size-limit/2494/5 "2017-10-02T15:44:43Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.