dwbutler / logstash-logger

Ruby logger that writes logstash events
MIT License
456 stars 119 forks source link

logs sending, but greylog failing to parse do to not being compressed #149

Open krainboltgreene opened 5 years ago

krainboltgreene commented 5 years ago

My logstash-logger and lograge setup:

config.logstash.uri = ENV.fetch("LOGSTASH_ORIGIN")
config.logstash.formatter = :json

config.lograge.enabled = true
config.lograge.base_controller_class = ["ActionController::API", "ActionController::Base"]
config.lograge.formatter = Lograge::Formatters::Logstash.new
config.lograge.custom_payload do |event|
  {
    host: event.request&.host,
    session_id: event.request&.cookie_jar.encrypted[config.session_options.fetch(:key)]&.fetch("session_id"),
    remote_ip: event.request&.remote_ip,
    context_id: event.request&.request_id,
    params: event.params.except("controller", "action", "format", "id")
  }.transform_values(&:presence).compact
end

Here's what logstash say:

logstash_1          | [2018-11-26T23:28:20,771][WARN ][logstash.inputs.gelf     ] Gelfd failed to parse a message skipping {:exception=>#<Gelfd::UnknownHeaderError: Could not find parser for header: [123, 34]>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in `parse'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-gelf-3.1.1/lib/logstash/inputs/gelf.rb:212:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-gelf-3.1.1/lib/logstash/inputs/gelf.rb:93:in `block in run'"]}

Apparently according to a google search, this is related to logstash expecting gelf to receive a compression (gzip).