Gelfd failed to parse a message

Elastic Stack Logstash
1

Hello,

I have a gelf input

gelf {
host => "0.0.0.0"
port => 555
type => "gelf"
codec => "json"

   }
  }

I am getting this error:

[2017-06-14T20:53:03,518][WARN ][logstash.inputs.gelf ] Gelfd failed to parse a message skipping {:exception=>#<Gelfd::UnknownHeaderError: Could not find parser for header: [100, 101]>, :backtrace=>["/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in parse'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:104:inudp_listener'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:77:in run'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:443:ininputworker'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:436:in `start_input'"]}

2

What did that message look like? What comes immediately after "{:exception=>#" in your log? If you look carefully you'll note that what you posted was incomplete.

3

Sorry, here is the complete stack trace

[2017-06-15T23:01:41,149][WARN ][logstash.inputs.gelf ] Gelfd failed to parse a message skipping {:exception=>#,Gelfd::UnknownHeaderError: Could not find parser for header: [100, 101]>, :backtrace=>["/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in parse'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:104:inudp_listener'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:77:in run'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:443:ininputworker'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:436:in `start_input'"]}

4

Okay. Either the sender is using an encoding that Logstash's GELF parser doesn't support or the payload is damaged. Can you give an example of the payload the Logstash receives when this error happens? You can e.g. use Wireshark to capture a datagram. Feed it through e.g. hexdump so that non-printable characters can be read.

How did you configure the GELF output?

I don't think the codec => "json" setting is useful, by the way. It's probably harmless, but the gelf input automatically deserializes the JSON in the GELF payload.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.