GELF processing failed about seq-input-gelf HOT 8 CLOSED

Hi @Mattes83, thanks for getting in touch.

Do you have the "enable diagnostics" checkbox in the GELF input's settings page checked? I believe this will cause more information to be written when message parsing fails. (You can then see these messages by clicking the number with the zigzag arrow icon next to the input's name in the Settings > Apps screen.)

If you're running the input as a datalust/squelf Docker container instance, you can alternatively set GELF_ENABLE_DIAGNOSTICS=True in its environment.

Let me know if this helps,
Nick

from seq-input-gelf.

Hi Nick,

thanks for the hint where to find the diagnostic logs.
When using the docker version Seq does not list Sqelf Input under Settings -> Apps. I am not sure if this is a known quirk?!
In my case I could easily circumvent this by installing the GELF plugin via Seq's web ui and deactivating the sidecar container.

from seq-input-gelf.

Great, thanks for the follow-up, @Mattes83 👍

from seq-input-gelf.

Hi again,

I guess I closed this issue too early. I was able to enable the diagnostics, but there is still no information about the original message that could not be processed.

Do you have any idea how to track this down?

Best Regards

from seq-input-gelf.

Hi @Mattes83 - we'll put our heads together and let you know what we come up with. It might require enhancing the diagnostic, which is produced in: https://github.com/datalust/sqelf/blob/dev/sqelf/src/server/mod.rs#L210

from seq-input-gelf.

It looks like we only include the raw payload (what was originally sent by the GELF logger) on events that were parsed and processed correctly.

I'll improve our diagnostics a bit here by replacing our current error handling with anyhow so that we can include a portion of a payload that couldn't be parsed if we hit one. That might make it easier for you to track down where it's coming from.

from seq-input-gelf.

Hi @Mattes83 We've published a new version of the package and container (as version 2.0.298) that includes a fragment of the invalid payload when it can't be parsed. If you update your Seq app and keep the extended diagnostics enabled you should get some more details about the event that couldn't be parsed.

from seq-input-gelf.

Thats great news. I will try it with the updated version, thanks for the enhancement

from seq-input-gelf.