Hi,
this looks like a client sending in invalid data.
The error message says, that the literal string "default send string"
(without the quotes) was part of the JSON payload, where a boolean value
(true, false, or null) was expected.
In fact, the whole GELF message seems to consist of the string "default
send string" (without the quotes), which isn't valid JSON.
Cheers,
Jochen
On Wednesday, 16 November 2016 01:36:11 UTC+1, 5thfishie wrote:
>
> After an upgrade of graylog from 1.3 to 2.1.1 I'm seeing lots of errors in
> the server.log. I've determined which input is the issue, GELF UDP but I'm
> unable to determine the source. I'm not sure if this is a bug or an
> offending application that is submitting bad data to graylog. Is there a
> way to up the logging level on the input to try and determine the source of
> these messages?
>
> 2016-11-15T16:21:56.393-08:00 ERROR [DecodingProcessor] Unable to decode
> raw message RawMessage{id=ae94a190-ab92-11e6-bca1-005056935150,
> journalOffset=3150596, codec=gelf, payloadSize=19,
> timestamp=2016-11-16T00:21:56.393Z} on input <58237e45d238b734006cc51c>.
> 2016-11-15T16:21:56.393-08:00 ERROR [DecodingProcessor] Error processing
> message RawMessage{id=ae94a190-ab92-11e6-bca1-005056935150,
> journalOffset=3150596, codec=gelf, payloadSize=19,
> timestamp=2016-11-16T00:21:56.393Z}
> com.fasterxml.jackson.core.JsonParseException: Unrecognized token
> 'default': was expecting ('true', 'false' or 'null')
> at [Source: default send string; line: 1, column: 8]
> at
> com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1586)
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:521)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2754)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1820)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:708)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3847)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3792)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2332)
> ~[graylog.jar:?]
> at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:120)
> ~[graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146)
>
> ~[graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35)
>
> [graylog.jar:?]
> at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143)
> [graylog.jar:?]
> at
> com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
>
> [graylog.jar:?]
> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]
> 2016-11-15T16:21:58.178-08:00 ERROR [GelfCodec] Could not parse JSON,
> first 400 characters: default send string
> com.fasterxml.jackson.core.JsonParseException: Unrecognized token
> 'default': was expecting ('true', 'false' or 'null')
> at [Source: default send string; line: 1, column: 8]
> at
> com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1586)
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:521)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser._reportInvalidToken(ReaderBasedJsonParser.java:2754)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1820)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:708)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3847)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3792)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2332)
> ~[graylog.jar:?]
> at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:120)
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35)
>
> [graylog.jar:?]
> at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143)
> [graylog.jar:?]
> at
> com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
>
> [graylog.jar:?]
> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/928f424b-ab73-47ed-a7f8-9333086937b4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
