# Trouble sending GELF event **URL:** \ **Category:** Logstash\ **Created:** [July 3, 2015, 1:32pm UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868 "2015-07-03T13:32:09Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nzHillNet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nzhillnet/32/3423_2.png) [@nzHillNet](https://discuss.elastic.co/u/nzHillNet)\ **Post date:** [July 3, 2015, 1:32pm UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868/1 "2015-07-03T13:32:09Z")
Hi all, I see a few "Google" entries with this issue, but haven't located a fix. In short I have Windows event logs being shipped to Logstash with nxlog in JSON format. I don't currently have a filter, and the output goes elasticsearch and Graylog. Input and Output config is below: ``` input { tcp { codec => json_lines { charset => CP1252 } port => 1516 type => "winlog" } } output { elasticsearch { cluster => "hill_log" host => "192.168.0.10" node_name => "hillstash" } gelf { host => "192.168.0.10" port => "12201" short_message => "short_message" } } ``` This ends up with the following error log (sorry it a bit log, relevant pieces seem to be at the start and the end): ``` {:timestamp=>"2015-07-04T01:13:08.228000+1200", :message=>"Trouble sending GELF event", :gelf_event=>{"short_message"=>nil, "full_message"=>"%{message}", "host"=>"192.168.0.101", "_EventTime"=>"2015-07-04 01:13:08", "_Hostname"=>"jr02", "_SeverityValue"=>3, "_Severity"=>"WARNING", "_SourceName"=>"nxlog-ce", "_ProcessID"=>4056, "_Message"=>"stopping nxlog service", "_EventReceivedTime"=>1435929188, "_SourceModuleName"=>"internal", "_SourceModuleType"=>"im_internal", "_type"=>"winlog", "level"=>6}, :event=>#0}, @lut={}>, @cancelled=false, @data={"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, @metadata={"retry_count"=>0}, @accessors=#"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, @lut={"host"=>[{"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, "host"], "type"=>[{"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, "type"], "[type]"=>[{"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, "type"], "message"=>[{"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, "message"], "tags"=>[{"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, "tags"], "severity"=>[{"EventTime"=>"2015-07-04 01:13:08", "Hostname"=>"jr02", "SeverityValue"=>3, "Severity"=>"WARNING", "SourceName"=>"nxlog-ce", "ProcessID"=>4056, "Message"=>"stopping nxlog service", "EventReceivedTime"=>1435929188, "SourceModuleName"=>"internal", "SourceModuleType"=>"im_internal", "@version"=>"1", "@timestamp"=>"2015-07-03T13:13:08.223Z", "host"=>"192.168.0.101", "type"=>"winlog"}, "severity"]}>>, :error=>#, :level=>:warn} ``` Can anyone offer a solution to this? Thanks again. ---
**Author:** ![nzHillNet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nzhillnet/32/3423_2.png) [@nzHillNet](https://discuss.elastic.co/u/nzHillNet)\ **Post date:** [July 5, 2015, 8:27am UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868/2 "2015-07-05T08:27:29Z")
...posting for the archives... I solved this issue by adding the following filter: ``` filter { if [type] == "winlog" { mutate { add_field => { "message" => "%{Message}" } } } } ``` -- Roland ---
**Author:** ![mshar039](https://avatars.discourse-cdn.com/v4/letter/m/47e85d/32.png) [@mshar039](https://discuss.elastic.co/u/mshar039)\ **Post date:** [March 18, 2016, 11:20am UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868/3 "2016-03-18T11:20:58Z")
i am facing same issue, and tried to use your solution with adding the filter. but again got the error as below: Trouble sending GELF event {:gelf\_event=\>{"short\_message"=\>["", "%{Message}"], "full\_message"=\>",%{M........"path"=\>"/root/Desktop/Graylog/test.txt", "host"=\>"localhost.localdomain", "type"=\>"grayLog"}, "severity"]}\>\>, :error=\>#SocketError: send: name or service not known\>, :level=:warn} I have omitted the log and only shown the relevant things. Can u please help me with this. My config is input { file { path =\> "/root/Desktop/Graylog/test.log" start\_position =\> "beginning" type =\> "grayLog" sincedb\_path =\> "/dev/null" } } filter { if [type] == "grayLog" { mutate { add\_field =\> {"message" =\> "%{Message}"} } } } output { gelf { host =\> ["127.0.0.1:9000"] } } using logstash v2.2 with Graylog 1.3 I am a newbie in linux environment and tools. kindly help me. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 18, 2016, 12:04pm UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868/4 "2016-03-18T12:04:30Z")
@mshar039, please start a new thread for your unrelated problem. ---
**Author:** ![stevenlee87](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@stevenlee87](https://discuss.elastic.co/u/stevenlee87)\ **Post date:** [November 28, 2016, 10:00am UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868/5 "2016-11-28T10:00:04Z")
hello! This method is feasible for me. But why? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/trouble-sending-gelf-event/24868/6 "2017-07-06T04:30:11Z")