Logstash GELF input Json ParserError

Elastic Stack Logstash
1

Hi!
I'm experiencing an issue with the Logstash GELF input related to JSON parsing. It seems that there's some messages from Graylog that causes these errors:

[2021-10-20T05:21:59,443][ERROR][logstash.inputs.gelf     ][ppt_graylog_ingest][gelf-windows-udp] JSON parse failure. Falling back to plain-text {:error=>#<LogStash::Json::ParserError: Unrecognized token 'Exception': was expecting ('true', 'false' or 'null')
 at [Source: (byte[])"Exception: Failed to decode data: invalid compressed data -- crc error"; line: 1, column: 11]>, :data=>"\"Exception: Failed to decode data: invalid compressed data -- crc error\""}

[2021-10-20T05:54:36,944][ERROR][logstash.inputs.gelf     ][ppt_graylog_ingest][gelf-windows-udp] JSON parse failure. Falling back to plain-text {:error=>#<LogStash::Json::ParserError: Unrecognized token 'Exception': was expecting ('true', 'false' or 'null')
 at [Source: (byte[])"Exception: Failed to decode data: Unexpected end of ZLIB input stream"; line: 1, column: 11]>, :data=>"\"Exception: Failed to decode data: Unexpected end of ZLIB input stream\""}

However, I don't see why there's a Json ParserError in this case, as the plugin configuration doesn't try to cast the input to json:

input {
    gelf {
            id => "gelf-windows-udp"
            use_tcp => false
            use_udp => true
            port_udp => 12205
            remap => true
    }
}

Setup:

  • ELK Stack v 7.14.0
  • Logstash v 7.14.0
  • Logstash-input-gelf v 3.3.0

Do you have any thoughts on why this happens?

2

GELF is JSON. If it is not valid JSON then it is not valid GELF.

3

Thanks for your reply. Yeah, but as this message comes from Graylog, I would assume that it was already JSON.

However, I suspect that this issue might be related to the UDP buffer queue being filled up, I've increased the max size of that, and I'll observe whether that fixes the issue.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.