After an upgrade of graylog from 1.3 to 2.1.1 I'm seeing lots of errors in
the server.log. I've determined which input is the issue, GELF UDP but I'm
unable to determine the source. I'm not sure if this is a bug or an
offending application that is submitting bad data to graylog. Is there a
way to up the logging level on the input to try and determine the source of
these messages?
2016-11-15T16:21:56.393-08:00 ERROR [DecodingProcessor] Unable to decode
raw message RawMessage{id=ae94a190-ab92-11e6-bca1-005056935150,
journalOffset=3150596, codec=gelf, payloadSize=19,
timestamp=2016-11-16T00:21:56.393Z} on input <58237e45d238b734006cc51c>.
2016-11-15T16:21:56.393-08:00 ERROR [DecodingProcessor] Error processing
message RawMessage{id=ae94a190-ab92-11e6-bca1-005056935150,
journalOffset=3150596, codec=gelf, payloadSize=19,
timestamp=2016-11-16T00:21:56.393Z}
com.fasterxml.jackson.core.JsonParseException: Unrecognized token
'default': was expecting ('true', 'false' or 'null')
at [Source: default send string; line: 1, column: 8]
at
com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1586)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:521)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2754)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1820)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:708)
~[graylog.jar:?]
at
com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3847)
~[graylog.jar:?]
at
com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3792)
~[graylog.jar:?]
at
com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2332)
~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:120)
~[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146)
~[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87)
[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58)
[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35)
[graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143)
[graylog.jar:?]
at
com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
[graylog.jar:?]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]
2016-11-15T16:21:58.178-08:00 ERROR [GelfCodec] Could not parse JSON, first
400 characters: default send string
com.fasterxml.jackson.core.JsonParseException: Unrecognized token
'default': was expecting ('true', 'false' or 'null')
at [Source: default send string; line: 1, column: 8]
at
com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1586)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:521)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2754)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1820)
~[graylog.jar:?]
at
com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:708)
~[graylog.jar:?]
at
com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3847)
~[graylog.jar:?]
at
com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3792)
~[graylog.jar:?]
at
com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2332)
~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:120)
[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146)
[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87)
[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58)
[graylog.jar:?]
at
org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35)
[graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143)
[graylog.jar:?]
at
com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
[graylog.jar:?]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/130581a1-c16c-45c4-8345-11004155c12a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
