logstash-plugins / logstash-input-gelf

Apache License 2.0
20 stars 39 forks source link

How to find out what message is causing "Gelfd failed to parse a message skipping" errors #12

Open achechen opened 9 years ago

achechen commented 9 years ago

Hello,

My logstash.log is full of error lines like below:

{:timestamp=>"2015-05-22T09:09:28.649000-0500", :message=>"Gelfd failed to parse a message skipping", :exception=>#<Gelfd::UnknownHeaderError: Could not find parser for header: [100, 101]>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in parse'", "/opt/logstash/lib/logstash/inputs/gelf.rb:83:inudp_listener'", "/opt/logstash/lib/logstash/inputs/gelf.rb:60:in run'", "/opt/logstash/lib/logstash/pipeline.rb:163:ininputworker'", "/opt/logstash/lib/logstash/pipeline.rb:157:in `start_input'"], :level=>:warn}

How am I supposed to find out what message is causing this error message (logstash is receiving thousands of messages every second from thousads of different hosts so manual check is not an option).

It would be great if you include the failed message in the log. Also, can you think of an another way to catch the message?