Dissecting google logs textPayLoad

[jamesp220291 (james)]

Hi

Thats the error in my logs, and not how the textPayload fields looks. (Slightly confusing)

[Badger]

@jamesp220291

Thats the error in my logs, and not how the textPayload fields looks. (Slightly confusing)

The error message in your logstash logs contains a complete copy of the event it failed to dissect. That looks like this. The textPayload field does not contain a domain_name or ip_address

     "textPayload" => "WARN [2019-06-21 19:04:23,653] org.eclipse.jetty.http.HttpParser: Illegal character 0x16 in state=START for buffer HeapByteBuffer@5b915ba[p=1,l=138,c=8192,r=137]={\\x16<<<\\x03\\x01\\x00\\x85\\x01\\x00\\x00\\x81\\x03\\x03\\xD1f\\xEf\\xDa)N\\r...\\x05\\x03\\x02\\x01\\x02\\x03\\xFf\\x01\\x00\\x01\\x00\\x00\\x12\\x00\\x00>>>-cache,no-store\\r\\n...\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\n",
"receiveTimestamp" => "2019-06-21T19:04:29.064943045Z",
          "labels" => {
            "container.googleapis.com/stream" => "stdout",
       "compute.googleapis.com/resource_name" => "fluentd-gcp-v3.2.0-f4hpp",
          "container.googleapis.com/pod_name" => "service-info-56dd7f4b88-q68m2",
    "container.googleapis.com/namespace_name" => "default"
},
        "resource" => {
      "type" => "container",
    "labels" => {
           "instance_id" => "5fffff47841",
          "cluster_name" => "euw1d-kube-name",
                  "zone" => "europe-west1-d",
            "project_id" => "project-id",
          "namespace_id" => "default",
        "container_name" => "service-server",
                "pod_id" => "service-info-56dd7f4b88-q68m2"
    }
},
[...]

[jamesp220291 (james)]

I feel really stupid right now,

But you are absolutely right, I have downloaded the logs and gone through them, and that entry is there.

Seems to be a problem with the code that creates this payload.

Thank you :)!