# Gelfd failed to parse a message

**URL:** <https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462>\
**Category:** Logstash\
**Created:** [June 14, 2017, 9:44pm UTC](https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462 "2017-06-14T21:44:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [June 14, 2017, 9:44pm UTC](https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462/1 "2017-06-14T21:44:54Z")

</div>

Hello,

I have a gelf input

gelf {  
host =\> "0.0.0.0"  
port =\> 555  
type =\> "gelf"  
codec =\> "json"

```
   }
  } 

```

I am getting this error:

[2017-06-14T20:53:03,518][WARN][logstash.inputs.gelf] Gelfd failed to parse a message skipping {:exception=\>#\<Gelfd::UnknownHeaderError: Could not find parser for header: [100, 101]\>, :backtrace=\>["/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in `parse'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:104:in`udp\_listener'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:77:in `run'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:443:in`inputworker'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:436:in `start\_input'"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 15, 2017, 7:46pm UTC](https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462/2 "2017-06-15T19:46:16Z")

</div>

What did that message look like? What comes immediately after "{:exception=\>#" in your log? If you look carefully you'll note that what you posted was incomplete.

---

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [June 15, 2017, 11:03pm UTC](https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462/3 "2017-06-15T23:03:22Z")

</div>

Sorry, here is the complete stack trace

[2017-06-15T23:01:41,149][WARN][logstash.inputs.gelf] Gelfd failed to parse a message skipping {:exception=\>#,Gelfd::UnknownHeaderError: Could not find parser for header: [100, 101]\>, :backtrace=\>["/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in `parse'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:104:in`udp\_listener'", "/home/t/logstash-5.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-gelf-3.0.2/lib/logstash/inputs/gelf.rb:77:in `run'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:443:in`inputworker'", "/home/t/logstash-5.4.1/logstash-core/lib/logstash/pipeline.rb:436:in `start\_input'"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 16, 2017, 5:24am UTC](https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462/4 "2017-06-16T05:24:21Z")

</div>

Okay. Either the sender is using an encoding that Logstash's GELF parser doesn't support or the payload is damaged. Can you give an example of the payload the Logstash receives when this error happens? You can e.g. use Wireshark to capture a datagram. Feed it through e.g. hexdump so that non-printable characters can be read.

How did you configure the GELF output?

I don't think the `codec => "json"` setting is useful, by the way. It's probably harmless, but the gelf input automatically deserializes the JSON in the GELF payload.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2017, 5:24am UTC](https://discuss.elastic.co/t/gelfd-failed-to-parse-a-message/89462/5 "2017-07-14T05:24:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.