search

KongZ / graylog-plugin-slack-notification

Graylog Slack Plugin
Apache License 2.0
9 stars 4 forks source link

Slack responds with http 414 code #12

Closed onmomo closed 3 years ago

onmomo commented 3 years ago

For certain alerts, probably those with long messages, the following can be found in the logs. Slack is connected via slack bot token.

2020-09-23 14:10:56,364 ERROR: org.graylog.scheduler.JobExecutionEngine - Job execution error - trigger=5f6b576fdb5bbc4dcb91f92c job=5f6b33e9db5bbc4dcb91c862
org.graylog.scheduler.JobExecutionException: Failed permanently to execute notification, giving up - <5f6b33e9db5bbc4dcb91c861/Alert on alerts-aws-euwest1-dev/slack-notification-v1>
    at org.graylog.events.notifications.EventNotificationExecutionJob.execute(EventNotificationExecutionJob.java:156) ~[graylog.jar:?]
    at org.graylog.scheduler.JobExecutionEngine.executeJob(JobExecutionEngine.java:166) ~[graylog.jar:?]
    at org.graylog.scheduler.JobExecutionEngine.lambda$handleTrigger$2(JobExecutionEngine.java:144) ~[graylog.jar:?]
    at com.codahale.metrics.Timer.time(Timer.java:137) ~[graylog.jar:?]
    at org.graylog.scheduler.JobExecutionEngine.handleTrigger(JobExecutionEngine.java:144) ~[graylog.jar:?]
    at org.graylog.scheduler.JobExecutionEngine.lambda$execute$0(JobExecutionEngine.java:119) ~[graylog.jar:?]
    at org.graylog.scheduler.worker.JobWorkerPool.lambda$execute$0(JobWorkerPool.java:110) ~[graylog.jar:?]
    at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_265]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_265]
    at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_265]
Caused by: org.graylog.events.notifications.PermanentEventNotificationException: Could not send message to Slack.
    at co.omise.graylog.plugins.slack.SlackNotification.execute(SlackNotification.java:64) ~[?:?]
    at org.graylog.events.notifications.EventNotificationExecutionJob.execute(EventNotificationExecutionJob.java:135) ~[graylog.jar:?]
    ... 11 more
Caused by: java.lang.RuntimeException: Could not send message to Slack.
    at co.omise.graylog.plugins.slack.SlackNotification.send(SlackNotification.java:147) ~[?:?]
    at co.omise.graylog.plugins.slack.SlackNotification.execute(SlackNotification.java:58) ~[?:?]
    at org.graylog.events.notifications.EventNotificationExecutionJob.execute(EventNotificationExecutionJob.java:135) ~[graylog.jar:?]
    ... 11 more
Caused by: co.omise.graylog.plugins.slack.SlackClient$SlackClientException: Unexpected HTTP response status 414
    at co.omise.graylog.plugins.slack.SlackClient.send(SlackClient.java:128) ~[?:?]
    at co.omise.graylog.plugins.slack.SlackNotification.send(SlackNotification.java:145) ~[?:?]
    at co.omise.graylog.plugins.slack.SlackNotification.execute(SlackNotification.java:58) ~[?:?]
    at org.graylog.events.notifications.EventNotificationExecutionJob.execute(EventNotificationExecutionJob.java:135) ~[graylog.jar:?]
    ... 11 more
 Wrap lines
KongZ commented 3 years ago

Thanks for reporting. It seems like the message is too big. But I can't find what is the maximum size that Slack API can handle.

To resolve this problem, you may need to exclude long value fields from message.

onmomo commented 3 years ago

Yes, this is because the slack message is sent as URL encoded params with a GET request to the Slack API that quickly hits the limit. The slack message should be sent via a form POST.

KongZ commented 3 years ago

@onmomo I've fixed the method. Please check out release https://github.com/omise/graylog-plugin-slack-notification/releases/tag/v3.3.4