View log entry in Graylog

(Mohamed) #1


I got error while parsing a log entry. I tried to look for the message using the message lookup but i couldn’t find this particular message causing the problem to my extractors (using Message ID as 75600dd0-57b0-11e8-a044-000c299fd582 and graylog_0 as the index). Any idea how i can get it without trying to dig back on my servers logs?

Thanks in advance…


Failed to index message: index=<graylog_0> id=<75600dd0-57b0-11e8-a044-000c299fd582> error=<{"type":"mapper_parsing_exception","reason":"failed to parse [response_time]","caused_by":{"type":"number_format_exception","reason":"For input string: \"Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET4.0C;+.NET4.0E;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729)\""}}>

(Jochen) #2

The message wasn’t indexed, so you won’t be able to find it.

The error message says, that the “response_time” field is expected to be a number but that it contained a string.

As mentioned in Graylog monitor its own logs, you can use the processing pipeline to check the field content and rename the field, if it doesn’t contain a number.

Ultimately, it looks like the following problem:

(system) closed #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.