Yet another "has empty mandatory "short_message" field" issue

Graylog Central (peer support)
1

Hi,

Althought my NXlog.conf file generated all contain, for each output, the following:

Exec $short_message = $raw_event; # Avoids truncation of the short_message field.

The logs fill with:

2018-03-14_14:19:51.94287 ERROR [DecodingProcessor] Error processing message RawMessage{id=7bf32182-2792-11e8-a367-005056ae6767, journalOffset=209541, codec=gelf, payloadSize=261, timestamp=2018-03-14T14:17:53.304Z, remoteAddress=/192.168.20.150:49681}
2018-03-14_14:19:51.94324 java.lang.IllegalArgumentException: GELF message <7bf32182-2792-11e8-a367-005056ae6767> (received from <192.168.20.150:49681>) has empty mandatory "short_message" field.

Making the process buffer and journal fill to maximum. This brings the box to a halt rendering Graylog useless.

I see many posted about this before without much success to solve the problem. Any solution? Should I change to *beat instead of nxlog? What can be done?

Graylog 2.4.3+2c41897 on graylog (Oracle Corporation 1.8.0_161 on Linux 4.2.0-42-generic)

Thanks

2

Ok so I set the graylog internal logging to Fatal only and the issue resolved itself. Obviously the log msg stopped but also the process buffer started clearing. That last part is a really odd behaviour.

EDIT: so after a reboot, the internal logging reverts to “info” and again by setting to “fatal” the process buffer starts working again. Confirmed but the filling of output buffer. I recommend to disable “internal logging” altogether for a workaround until this is fix by Graylog team (if ever). Hopes it helps someone else :slight_smile:

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.