New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parsing issues better notification #2717

Open
JulioQc opened this Issue Aug 19, 2016 · 1 comment

Comments

Projects
None yet
3 participants
@JulioQc

JulioQc commented Aug 19, 2016

Expected Behavior

Notification in WebUI.

Current Behavior

Only logged in system logs. Need to proactively check logs for the issue.

Possible Solution

Notification under overview

Steps to Reproduce (for bugs)

  1. Create CSV parsing (i.e Exchange SMTP logs)
  2. Wait for it to gather some logs
  3. Check server's log for ERROR: org.graylog2.plugin.inputs.Extractor - Could not apply converter [csv] of extractor [a8f941c0-4f7e-11e6-bded-005056ae6767].

Context

So this is just an improvement suggestion for when CSV parsing fails like this:

2016-08-19_12:40:16.71865 2016-08-19 08:40:16,717 ERROR: org.graylog2.plugin.inputs.Extractor - Could not apply converter [csv] of extractor [a8f941c0-4f7e-11e6-bded-005056ae6767].
2016-08-19_12:40:16.71977 java.lang.NullPointerException
2016-08-19_12:40:16.72395       at java.util.HashMap.putMapEntries(HashMap.java:500) ~[?:1.8.0_77]
2016-08-19_12:40:16.72397       at java.util.HashMap.<init>(HashMap.java:489) ~[?:1.8.0_77]
2016-08-19_12:40:16.72488       at org.graylog2.plugin.inputs.Extractor.runConverters(Extractor.java:250) [graylog.jar:?]
2016-08-19_12:40:16.72627       at org.graylog2.plugin.inputs.Extractor.runExtractor(Extractor.java:228) [graylog.jar:?]
2016-08-19_12:40:16.72868       at org.graylog2.filters.ExtractorFilter.filter(ExtractorFilter.java:62) [graylog.jar:?]
2016-08-19_12:40:16.73078       at org.graylog2.messageprocessors.MessageFilterChainProcessor.process(MessageFilterChainProcessor.java:100) [graylog.jar:?]
2016-08-19_12:40:16.73164       at org.graylog2.buffers.processors.ServerProcessBufferProcessor.handleMessage(ServerProcessBufferProcessor.java:56) [graylog.jar:?]
2016-08-19_12:40:16.73304       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.dispatchMessage(ProcessBufferProcessor.java:82) [graylog.jar:?]
2016-08-19_12:40:16.73491       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:61) [graylog.jar:?]
2016-08-19_12:40:16.73563       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35) [graylog.jar:?]
2016-08-19_12:40:16.73849       at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139) [graylog.jar:?]
2016-08-19_12:40:16.73854       at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
2016-08-19_12:40:16.73991       at java.lang.Thread.run(Thread.java:745) [?:1.8.0_77]

Would be nice to be notified to adjust or change extractor without having to "tail" the server logs to spot those issues (I guess Graylog could stream it's own logs and alert, as a workaround)
Not much impact except losing those badly structured logs.

Your Environment

  • Graylog Version: 2.0.3 OVA
  • Elasticsearch Version:
  • MongoDB Version:
  • Operating System:
  • Browser version:

@kroepke kroepke added the feature label Aug 22, 2016

joschi added a commit that referenced this issue Aug 23, 2016

joschi added a commit that referenced this issue Aug 23, 2016

@JulioQc

This comment has been minimized.

JulioQc commented Aug 23, 2016

Cheers :)

edmundoa added a commit that referenced this issue Aug 23, 2016

@jalogisch jalogisch added the triaged label Feb 2, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment