Hi all,
I have a problem during Exchange ingestion using GELF TCP input.
Sometimes I have this errors in the graylog log:
2021-03-30 17:12:18,102 ERROR: org.graylog2.plugin.inputs.transports.NettyTransport - Error in Input [Beats/5f8d9d1cc713ac0022401271] (channel [id: 0x0a0f0731, /10.244.1.0:43488 => /10.244.0.46:5044])
java.lang.Exception: Unknown beats protocol version: 71
at org.graylog.plugins.beats.BeatsFrameDecoder.checkVersion(BeatsFrameDecoder.java:163) ~[?:?]
2021-03-30 17:12:18,119 ERROR: org.graylog2.plugin.inputs.transports.NettyTransport - Error in Input [Beats/5f8d9d1cc713ac0022401275] (channel [id: 0xb31f742c, /10.244.1.0:45212 :> /10.244.0.46:5045])
java.lang.Exception: Unknown beats protocol version: 69
With them I have also strange errors about jackson Json perser exception like
2021-03-30 17:16:49,965 ERROR: org.graylog2.inputs.codecs.GelfCodec - Could not parse JSON, first 400 characters:
com.fasterxml.jackson.core.JsonParseException: Illegal character ((CTRL-CHAR, code 1)): only regular white space (\r, \n, \t) is allowed between tokens
at [Source: ; line: 1, column: 2] ← CTRL-CHAR with code 8 too
2021-03-30 17:16:49,965 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=b6d85d50-917b-11eb-9560-0af629b282c1, journalOffset=4703247, codec=gelf, payloadSize=3, timestamp=2021-03-30T17:16:49.957Z, remoteAddress=/10.244.2.0:39942}
com.fasterxml.jackson.core.JsonParseException: Unexpected character (‘�’ (code 65533 / 0xfffd)): expected a valid value (number, String, array, object, ‘true’, ‘false’ or ‘null’)
at [Source: ��; line: 1, column: 2]
that give me the final error:
2021-03-30 17:16:49,965 ERROR: org.graylog2.plugin.inputs.transports.NettyTransport - Error in Input [GELF TCP/5f8d9d1cc713ac0022401246] (channel [id: 0x0c3659c8, /10.244.2.0:39942 :> /10.244.0.46:12201])
java.lang.IllegalStateException: GELF message is too short. Not even the type header would fit.
What i should check? After this errors Graylog stop to work and I need to restart it.
I’m using Graylog 2.5.2
The Exchange data are sending via LogStash into GELF input
Thanks very much to those who want to help me