Short_message and host must be set

Elastic Stack Logstash
1

Hi..

I have a logstash and i try to connect to graylog2.

The logstash configuration is:

input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/XXXX.crt"
ssl_key => "/etc/pki/tls/private/YYYY.key"
client_inactivity_timeout => 0
}
udp {
port => 10514
codec => "json"
type => "rsyslog"
}
}

output {

gelf {
host => "x.x.x.x"
short_message => "test"
port => 12201
}
}

but, logstash show this error:

[2020-01-27T11:39:47,576][WARN ][logstash.outputs.gelf ] Trouble sending GELF event {:gelf_event=>{"short_message"=>nil, "full_message"=>"%{message}", "host"=>"{"name":"idm-fva-01.ucr.ac.cr","id":"9e2a96b31f7ba3ebad15a056c85382d2","os":{"name":"CentOS Linux","family":"redhat","version":"7 (Core)","platform":"centos","codename":"Core"},"architecture":"x86_64","containerized":false}", "_tags"=>"beats_input_raw_event", "_nginx_stubstatus"=>{"dropped"=>0, "current"=>1, "requests"=>706420, "reading"=>0, "active"=>1, "writing"=>1, "hostname"=>"127.0.0.1", "waiting"=>0, "handled"=>167106, "accepts"=>167106}, "_beat_hostname"=>"idm-fva-01.ucr.ac.cr", "_beat_version"=>"6.8.1", "_beat_name"=>"idm-fva-01.ucr.ac.cr", "_event_dataset"=>"nginx.stubstatus", "_event_duration"=>829344, "_metricset_host"=>"127.0.0.1", "_metricset_rtt"=>829, "_metricset_name"=>"stubstatus", "_metricset_module"=>"nginx", "level"=>6}, :event=>#LogStash::Event:0x70a5e5d8, :error=>#<ArgumentError: short_message is missing. Options version, short_message and host must be set.>}

Can any help me.

Thanks a lot.

2

I think you would get that if the message has neither a [message] field (which you will not have with a json codec) nor a [test] field.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.