# Gelfd Parsing failed

**URL:** <https://discuss.elastic.co/t/gelfd-parsing-failed/172027>\
**Category:** Logstash\
**Created:** [March 12, 2019, 7:50pm UTC](https://discuss.elastic.co/t/gelfd-parsing-failed/172027 "2019-03-12T19:50:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sashi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sashi/32/54966_2.png) [@Sashi](https://discuss.elastic.co/u/Sashi)\
**Post date:** [March 12, 2019, 7:50pm UTC](https://discuss.elastic.co/t/gelfd-parsing-failed/172027/1 "2019-03-12T19:50:47Z")

</div>

Hello,

I am getting this error on Logstash  
[2019-03-12T15:32:41,450][WARN][logstash.inputs.gelf] Gelfd failed to parse a message skipping {:exception=\>#\<Gelfd::TooManyChunksError: 185 greater than 128\>. it started recently. We never had this issue before. nothing changed on Logstash

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 12, 2019, 8:23pm UTC](https://discuss.elastic.co/t/gelfd-parsing-failed/172027/2 "2019-03-12T20:23:22Z")

</div>

Something is sending you something that looks like a gelf message (the first two bytes are the magic number for chunked gelf), but the 12th byte contains 185. The gelf definition says the 12th byte is limited to 128.

You need to fix whatever is sending those messages. To find it you are going to need tcpdump/wireshark to find the offending messages.

---

<div class="post-metadata">

**Author:** ![Sashi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sashi/32/54966_2.png) [@Sashi](https://discuss.elastic.co/u/Sashi)\
**Post date:** [March 13, 2019, 3:38pm UTC](https://discuss.elastic.co/t/gelfd-parsing-failed/172027/3 "2019-03-13T15:38:48Z")

</div>

Thanks for the response  
We have  
input {  
gelf {}  
} . in Logstash. We will get only glf messages.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2019, 3:51pm UTC](https://discuss.elastic.co/t/gelfd-parsing-failed/172027/4 "2019-04-10T15:51:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.