# Dissecting google logs textPayLoad

**URL:** <https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300>\
**Category:** Logstash\
**Created:** [July 1, 2019, 11:36am UTC](https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300 "2019-07-01T11:36:40Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![jamesp220291](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\
**Post date:** [July 1, 2019, 8:59pm UTC](https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300/21 "2019-07-01T20:59:10Z")

</div>

Hi

Thats the error in my logs, and not how the textPayload fields looks. (Slightly confusing)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 1, 2019, 9:10pm UTC](https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300/22 "2019-07-01T21:10:30Z")

</div>

> [@jamesp220291](#):
>
> Thats the error in my logs, and not how the textPayload fields looks. (Slightly confusing)

The error message in your logstash logs contains a complete copy of the event it failed to dissect. That looks like this. The textPayload field does not contain a domain\_name or ip\_address

```
     "textPayload" => "WARN [2019-06-21 19:04:23,653] org.eclipse.jetty.http.HttpParser: Illegal character 0x16 in state=START for buffer HeapByteBuffer@5b915ba[p=1,l=138,c=8192,r=137]={\\x16<<<\\x03\\x01\\x00\\x85\\x01\\x00\\x00\\x81\\x03\\x03\\xD1f\\xEf\\xDa)N\\r...\\x05\\x03\\x02\\x01\\x02\\x03\\xFf\\x01\\x00\\x01\\x00\\x00\\x12\\x00\\x00>>>-cache,no-store\\r\\n...\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\n",
"receiveTimestamp" => "2019-06-21T19:04:29.064943045Z",
          "labels" => {
            "container.googleapis.com/stream" => "stdout",
       "compute.googleapis.com/resource_name" => "fluentd-gcp-v3.2.0-f4hpp",
          "container.googleapis.com/pod_name" => "service-info-56dd7f4b88-q68m2",
    "container.googleapis.com/namespace_name" => "default"
},
        "resource" => {
      "type" => "container",
    "labels" => {
           "instance_id" => "5fffff47841",
          "cluster_name" => "euw1d-kube-name",
                  "zone" => "europe-west1-d",
            "project_id" => "project-id",
          "namespace_id" => "default",
        "container_name" => "service-server",
                "pod_id" => "service-info-56dd7f4b88-q68m2"
    }
},
[...]

```

---

<div class="post-metadata">

**Author:** ![jamesp220291](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\
**Post date:** [July 2, 2019, 6:22am UTC](https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300/23 "2019-07-02T06:22:42Z")

</div>

I feel really stupid right now,

But you are absolutely right, I have downloaded the logs and gone through them, and that entry is there.

Seems to be a problem with the code that creates this payload.

Thank you :)!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2019, 6:22am UTC](https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300/24 "2019-07-30T06:22:46Z")

</div>

Closed on July 30, 2019, 6:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/dissecting-google-logs-textpayload/188300.md?page=1)