New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow empty/blank "short_message" field if "message" exists #4055

Merged
merged 1 commit into from Aug 3, 2017

Conversation

Projects
None yet
3 participants
@joschi
Contributor

joschi commented Aug 3, 2017

Refs #4053

@joschi joschi added this to the 2.3.1 milestone Aug 3, 2017

@bernd bernd self-assigned this Aug 3, 2017

@bernd

bernd approved these changes Aug 3, 2017

@bernd

This comment has been minimized.

Member

bernd commented Aug 3, 2017

Waiting for CI to turn green.

@bernd bernd merged commit e1d2f8a into 2.3 Aug 3, 2017

4 checks passed

ci-web-linter Jenkins build graylog-pr-linter-check 1841 has succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
continuous-integration/travis-ci/push The Travis CI build passed
Details
graylog-project/pr Jenkins build graylog-project-pr-snapshot 358 has succeeded
Details

@bernd bernd deleted the relax-gelf-validation-2.3 branch Aug 3, 2017

@123dev

This comment has been minimized.

123dev commented Jan 30, 2018

Hi,

If this was relaxed again in 2.3.2, why Am I seeing these errors in Graylog 2.4.1?

2018-01-30_17:37:46.87892 java.lang.IllegalArgumentException: GELF message <48d23c20-05e4-11e8-9836-0eeefea68770> (received from <127.0.0.1:34204>) has empty mandatory "short_message" field.
2018-01-30_17:37:46.87942       at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
2018-01-30_17:37:46.88043       at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
2018-01-30_17:37:46.88177       at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
2018-01-30_17:37:46.88240       at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
2018-01-30_17:37:46.88358       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
2018-01-30_17:37:46.88409       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
2018-01-30_17:37:46.88523       at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
2018-01-30_17:37:46.88571       at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
2018-01-30_17:37:46.88632       at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
2018-01-30_17:37:47.12338 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=4901b090-05e4-11e8-9836-0eeefea68770, journalOffset=4025517987, codec=gelf, payloadSize=143, timestamp=2018-01-30T17:37:47.033Z, remoteAddress=/127.0.0.1:34204} on input <553fd381e4b0f82f8f1149c6>.
2018-01-30_17:37:47.12343 ERROR [DecodingProcessor] Error processing message RawMessage{id=4901b090-05e4-11e8-9836-0eeefea68770, journalOffset=4025517987, codec=gelf, payloadSize=143, timestamp=2018-01-30T17:37:47.033Z, remoteAddress=/127.0.0.1:34204}
2018-01-30_17:37:47.12493 java.lang.IllegalArgumentException: GELF message <4901b090-05e4-11e8-9836-0eeefea68770> (received from <127.0.0.1:34204>) has empty mandatory "short_message" field.
2018-01-30_17:37:47.12564       at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:252) ~[graylog.jar:?]
2018-01-30_17:37:47.12624       at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:134) ~[graylog.jar:?]
2018-01-30_17:37:47.12748       at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
2018-01-30_17:37:47.12826       at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
2018-01-30_17:37:47.13002       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:74) [graylog.jar:?]
2018-01-30_17:37:47.13059       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
2018-01-30_17:37:47.13121       at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
2018-01-30_17:37:47.13253       at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
2018-01-30_17:37:47.13314       at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
2018-01-30_17:37:47.15171 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=490e5ac3-05e4-11e8-9836-0eeefea68770, journalOffset=4025518027, codec=gelf, payloadSize=143, timestamp=2018-01-30T17:37:47.116Z, remoteAddress=/127.0.0.1:34204} on input <553fd381e4b0f82f8f1149c6>.
2018-01-30_17:37:47.15245 ERROR [DecodingProcessor] Error processing message RawMessage{id=490e5ac3-05e4-11e8-9836-0eeefea68770, journalOffset=4025518027, codec=gelf, payloadSize=143, timestamp=2018-01-30T17:37:47.116Z, remoteAddress=/127.0.0.1:34204}

Seeing that the host is 127.0.0.1, these are probably syslog messages from the host running graylog.
rsyslog configuration from graylog:

$template GRAYLOGRFC5424,"<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
*.* @graylog-server:514;GRAYLOGRFC5424

Thanks

@joschi

This comment has been minimized.

Contributor

joschi commented Jan 31, 2018

@123dev Syslog inputs don't use the GELF codec.

We are using GitHub issues for tracking bugs in Graylog itself, but this doesn't look like one. Please post this issue to our discussion forum or join the #graylog channel on freenode IRC.

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment