All of my incoming GELF messages on UDP are being rejected as incomplete. I need to find out why the messages are being rejected as incomplete. Can anyone advise me here?
I am running on one node - graylog-server-0.20.1 - graylog2-web-interface 0.20.1 - elasticsearch 0.90.,10 - mongodb 2.4.9 - Ubutnu server 13 - graylog2 is configured with one node, one input (GELF UDP, global, port 12201) -- I also tried a local input attached to the server node I have my development environment set up on another node, running a Java jetty server configured with logback and the me.moocar gelf appender. I was able to install graylog2 and it worked. I was able to view log messages as they arrived. After working for a whlie, graylog stopped ingesting messages. I validated that: - UDP connectivitiy between the nodes is working - the jetty application is sending UDP messages to the UDP port on the graylog node - the graylog input is receiving messages The metrics page on the graylog2 web shows that the UDP input is receiving messages and classifying them as incomplete - org.graylog2.inputs.gelf.udp.GELFUDPInput.5328d7c8e4b09879db5d8902.incomingMessages <http://graylog-rb:9000/system/metrics/node/ef3b61b5-1f5a-4f7d-a652-3b7a4a62b12d?prefilter=org.graylog2.inputs.gelf.udp.GELFUDPInput.5328d7c8e4b09879db5d8902#> Meter Total:258150 eventsMean:564.28 events/sec1 minute avg:112.92 events/sec5 minute avg:320.67 events/sec15 minute avg:320.67 events/sec - org.graylog2.inputs.gelf.udp.GELFUDPInput.5328d7c8e4b09879db5d8902.incompleteMessages <http://graylog-rb:9000/system/metrics/node/ef3b61b5-1f5a-4f7d-a652-3b7a4a62b12d?prefilter=org.graylog2.inputs.gelf.udp.GELFUDPInput.5328d7c8e4b09879db5d8902#> Meter Total:258150 eventsMean:564.36 events/sec1 minute avg:112.92 events/sec5 minute avg:320.67 events/sec15 minute avg:320.67 events/sec I configured the log level for the graylog2 subsystem to "TRACE" I am seeting lots of log messages from the graylog2 server like this: 2014-03-21 12:50:10,054 DEBUG: org.graylog2.inputs.gelf.gelf.GELFProcessor - Skipping incomplete message. 2014-03-21 12:50:10,055 DEBUG: org.graylog2.inputs.gelf.gelf.GELFProcessor - Skipping incomplete message. 2014-03-21 12:50:10,056 DEBUG: org.graylog2.inputs.gelf.gelf.GELFProcessor - Skipping incomplete message. 2014-03-21 12:50:10,057 DEBUG: org.graylog2.inputs.gelf.gelf.GELFProcessor - Skipping incomplete message. 2014-03-21 12:50:10,058 DEBUG: org.graylog2.inputs.gelf.gelf.GELFProcessor - Skipping incomplete message. I need to find out why the messages are being rejected as incomplete. Can anyone advise me here? My GELF configuration is: * <appender name="graylog" class="me.moocar.logbackgelf.GelfAppender"> <facility>gelf-java</facility> <graylog2ServerHost>10.0.2.15</graylog2ServerHost> <graylog2ServerPort>12201</graylog2ServerPort> <useThreadName>true</useThreadName> <graylog2ServerVersion>0.9.6</graylog2ServerVersion> <chunkThreshold>1000</chunkThreshold> <messagePattern>%m%rEx</messagePattern> <shortMessagePattern>%.-100(%m%rEx})</shortMessagePattern> <hostName>my-dev</hostName> <staticAdditionalField>_environment:dev</staticAdditionalField> <staticAdditionalField>_application:my_app</staticAdditionalField> <additionalField>ipAddress:_ip_address</additionalField> <additionalField>httpStatus:_http_status</additionalField> <additionalField>requestMethod:_method</additionalField> <additionalField>resourceId:_resource</additionalField> <additionalField>session:_session</additionalField> <additionalField>requestId:_request_id</additionalField> <additionalField>member:_member_id</additionalField> <additionalField>loadBalancerKey:_db_host</additionalField> </appender>* Robert Blumen [email protected] symphonycommerce.com 363 Clementina St. San Francisco, CA 94103 -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
