Dissecting google logs textPayLoad

Elastic Stack Logstash
21

Hi

Thats the error in my logs, and not how the textPayload fields looks. (Slightly confusing)

22

The error message in your logstash logs contains a complete copy of the event it failed to dissect. That looks like this. The textPayload field does not contain a domain_name or ip_address

     "textPayload" => "WARN [2019-06-21 19:04:23,653] org.eclipse.jetty.http.HttpParser: Illegal character 0x16 in state=START for buffer HeapByteBuffer@5b915ba[p=1,l=138,c=8192,r=137]={\\x16<<<\\x03\\x01\\x00\\x85\\x01\\x00\\x00\\x81\\x03\\x03\\xD1f\\xEf\\xDa)N\\r...\\x05\\x03\\x02\\x01\\x02\\x03\\xFf\\x01\\x00\\x01\\x00\\x00\\x12\\x00\\x00>>>-cache,no-store\\r\\n...\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\n",
"receiveTimestamp" => "2019-06-21T19:04:29.064943045Z",
          "labels" => {
            "container.googleapis.com/stream" => "stdout",
       "compute.googleapis.com/resource_name" => "fluentd-gcp-v3.2.0-f4hpp",
          "container.googleapis.com/pod_name" => "service-info-56dd7f4b88-q68m2",
    "container.googleapis.com/namespace_name" => "default"
},
        "resource" => {
      "type" => "container",
    "labels" => {
           "instance_id" => "5fffff47841",
          "cluster_name" => "euw1d-kube-name",
                  "zone" => "europe-west1-d",
            "project_id" => "project-id",
          "namespace_id" => "default",
        "container_name" => "service-server",
                "pod_id" => "service-info-56dd7f4b88-q68m2"
    }
},
[...]
23

I feel really stupid right now,

But you are absolutely right, I have downloaded the logs and gone through them, and that entry is there.

Seems to be a problem with the code that creates this payload.

Thank you :)!

24

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.