Graylog2 / Graylog2/graylog2-server
Getting unidentified structure log data on fluentd from graylog
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
This is regarding the issue of unidentified structure log data we are getting currently which we are receiving from Graylog. Our pipeline is supposed to receive logs from graylog(via graylog GELF output) to fluentd (our content parser).
## Current Behavior
Example:
Message sent from graylog(seen on graylog-streams):-
{“log”:“2018-03-29 10:05:30,587 [] INFO [] Renewed service GATEWAY with instanceId Gateway:e0a6b5d98b3ee904a2d2c8129aaf9f1e and metadata {instanceId={spring.application.name}-{HOST}-${PORT0}, dockerImage=gateway, enableRegisterFilter=false, pub=true}\n”,“stream”:“stdout”,“time”:“2018-03-29T10:05:30.587644422Z”}
Message received at fluentd side:
{“message”:“\u0016\u0003\u0003\u0000x\u0001\u0000\u0000t\u0003\u0003Zm4l6ʷu:dRk\u0000\u0000\u0010,+/.
** \u0013\u0014\u0000\u0000/\u00005\u0001\u0000\u0000;\u0000"}**
## Context
We trying to send logs from Graylog to fluentd using graylog output plugin. We see proper logs at graylog streaming section, but it sends the log on fluentd in unstructured unidentified format.
This is regarding the issue of unidentified structure log data we are getting currently which we are receiving from Graylog. Our pipeline is supposed to receive logs from graylog(via graylog GELF output) to fluentd (our content parser).
-Although when we try to login to Graylog host and do telnet to fluentd with some sample message, we are able to get proper text logs on fluentd end.
Above observation hints that when we send logs using host - telnet, it comes in normal text format, although when the logs are sent using graylog to fluentd we are getting logs in unidentified structure. Unable to understand this scenario. Please let me know if any one faced such use case.
## Your Environment


* Graylog Version: Graylog 2.3.1
Contributor guide
Assessment
This issue has not been assessed yet.