Messages via input plugin not queryable via search (ex: gl2_source_input)

[fieldfoxWim]

Hi All

I have this plugin up and running on graylog2 0.91.2

Works fine

• plugin loads ok
• mqtt messages are received, parsed and processed
• Message counter in the right top corner increases when receiving messages
• Looking for a message via de Extractor>loadMessage works
  • _id: 14eb8cc0-86c8-11e4-b719-080027fcfbc7
  • index: graylog2_0
• defining a stream detecting and defining an output also works example output:

org.graylog2.outputs.LoggingOutput - Writing message: mqtt publish received source: 192.168.10.101 | message: {"x":"hoera2"} { timestamp: 46933-08-22T16:10:51.000Z | _mqtt_topic: home/test | _id: 14eb8cc0-86c8-11e4-b719-080027fcfbc7 | gl2_source_input: 54922bbf24ac84d1f4d7d93b | gl2_source_node: 1b1a3d09-4864-4e7f-8e1f-307bb79d1247 | _mqtt_received_timestamp: 1418915463051 | MqttPayload: {"x":"hoera2"} }

Does not work

When going to System>inputs>MQTT input>action>messages from this input it loads nothing. In the search bar at the top it states: gl2_source_input:54922bbf24ac84d1f4d7d93b which is obviously ok comparing the value with the logged output above.

It also states: 0 messages found

Attempts

I tried 2 attempts. Pushing the message directly to the processBuffer or by calling the processRawMessage of the InputMessage. Both with the same result.

Thanks in advance for time and effort. Best regards Wim

[joschi]

The timestamp of your message looks weird ("46933-08-22T16:10:51.000Z") and typically points to a wrong timestamp scale e. g. milliseconds since UNIX epoch instead of seconds since UNIX epoch (with optional decimal places for sub-second precision). In case of GELF 1.1 (https://www.graylog2.org/resources/gelf/specification) the timestamp should be seconds since UNIX epoch with optional decimal places.

So the search is basically correct: There are no messages from this input with a timestamp from within the last 8 hours. :wink:

[fieldfoxWim]

Hi Joshi

I was so focused on the gl2_source_input, that I never saw the weird timestamp. No it works like a charm. I lost a whole day on this. But it gained me some more insights in the graylog2 code.

Thank you very much. I think both issues on the mqtt plugin can be closed.

Best regards Wim

[joschi]

Thanks for your feedback!