search

wizecore / graylog2-output-syslog

Customizable, production ready syslog and ArcSight output plugin for Graylog
Apache License 2.0
38 stars 19 forks source link

Cannot cast java.lang.String to org.joda.time.DateTime #44

Open dani opened 3 years ago

dani commented 3 years ago

Hi I'm sending my logs with this plugin to a remote syslog host (UDP) using the CEF format. It mostly works, but I have frequent errors like this in mt server.log : 

2021-03-12T15:38:47.335+01:00 ERROR [OutputBufferProcessor] Error in output [class com.wizecore.graylog2.plugin.SyslogOutput].
java.lang.ClassCastException: Cannot cast java.lang.String to org.joda.time.DateTime
        at java.lang.Class.cast(Class.java:3369) ~[?:1.8.0_282]
        at org.graylog2.plugin.Message.getFieldAs(Message.java:660) ~[graylog.jar:?]
        at org.graylog2.plugin.Message.getTimestamp(Message.java:365) ~[graylog.jar:?]
        at com.wizecore.graylog2.plugin.CEFSender.send(CEFSender.java:120) ~[?:?]
        at com.wizecore.graylog2.plugin.SyslogOutput.write(SyslogOutput.java:220) ~[?:?]
        at org.graylog2.buffers.processors.OutputBufferProcessor$1.run(OutputBufferProcessor.java:191) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_282]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_282]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_282]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_282]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_282]

The server.log file can grow to several GB per day, mostly full with such error message. Unfortunatly, I have no idea how to identify which messages are causing this It's running a Graylog 4.0.5 with the latest version of this plugin.

huksley commented 3 years ago

Hi, apologies for a delay in replying to this.

Is this error still happening? Looking at the Graylog server source code I can see that it expects timestamp field in messages to be of type org.joda.time.DateTime

In a sense I just ask for a timestamp field in a message.