"No template provided" about seq-input-gelf HOT 14 CLOSED

Unfortunately we don't have any way in Seq to define an alternative message property, but we do have a bit of logic in this GELF server already that tries to find and set properties on nested JSON objects based on some common conventions. I think it would be reasonable for us to look for a property called message or msg and use it as Seq's @m property if one isn't set already. I'll put a PR together 👍

from seq-input-gelf.

Alrighty, I've opened up #96 to look for msg and message as fallback properties if we don't find CLEF's expected @m or @mt.

from seq-input-gelf.

Thanks @jirisykora83! Ah it looks like you've gotten it sorted, sorry I thought you were using the GELF container rather than the Seq App.

from seq-input-gelf.

Hey @jirisykora83 👋

The GELF input app in Seq does behave the same way as the sidecar container. It looks like you might be getting sent logs without any message or message template. If you go to your Data > Ingestion page and find your running GELF input in the table there, you should find a checkbox on its settings to Enable Diagnostics. This will also record the raw GELF message Seq received as a property of those events so we can see if they're sending a message some other way.

from seq-input-gelf.

Hey @KodrAus thanks for fast response.

example of raw_payload what I get from squidex {"version":"1.1","host":"docker-desktop","short_message":"{\"logLevel\":\"Information\",\"filters\":{\"userId\":\"6194006afa169d36f8aff353\",\"clientId\":\"squidex-frontend\",\"costs\":0},\"elapsedRequestMs\":1,\"timestamp\":\"2022-02-04T07:51:02Z\",\"app\":{\"name\":\"Squidex\",\"version\":\"6.5.0.0\",\"sessionId\":\"de3da4a9-4aff-4a71-bc00-d26aaa90923e\"},\"web\":{\"requestId\":\"00-0a349eaad8c34ef499082bda42e18da6-132037e497324648-01\",\"requestPath\":\"/api/users/6194006afa169d36f8aff353/notifications\",\"requestMethod\":\"GET\"}}","timestamp":1643961062.861,"level":6,"_command":"dotnet Squidex.dll","_container_id":"d7ce1aada02241a01fd0b440de699723063387e40b2283efc6ee4f3128fc67d3","_container_name":"squidex_squidex_squidex.1.wwumsdx84ocae84r2hwlne5k1","_created":"2022-02-03T15:57:53.2344417Z","_image_id":"sha256:fd6303378a4c01cbfd6d8292a779cd1bdff8192584d3d6cf2544a967c6f8bf21","_image_name":"squidex/squidex:6.5.0@sha256:bdd4226d44aed2b46c09df660cb2ee30d143d3194949ec23dfc84df3f2390df4","_tag":"d7ce1aada022"}

from seq-input-gelf.

Thanks @jirisykora83. Looking at the event there it doesn't look like Squidex is including any kind of message with their logs. I gave it a test locally and it does appear to include a message property in some of its events, but not in others.

from seq-input-gelf.

Is that something that must be fixed "at source" in this case Squidex or is there is the way to define what property of the message should be consider as candidate to display if "message" is not available (if I understand correctly seq is always show "message" and if there isn't any then show "No template provided" is that correct?).

from seq-input-gelf.

That would be perfect maybe you could add short_message as i open discussion in squidex forum (https://support.squidex.io/t/implemented-missing-message-property-in-log/3976/5) and it seems they make some changes which now include short_message

EDIT:

sorry short_message are actually not from squidex but docker itself so as you say message or msg should by fine.

from seq-input-gelf.

Circling back around here, we now support some message fallbacks so will go ahead and close this one now.

from seq-input-gelf.

Thanks for adding this feature. Is it already available in the latest stable release (docker)?

from seq-input-gelf.

Hi @jirisykora83. This should be up on Docker, yes.

from seq-input-gelf.

Hi @KodrAus I tried docker image with tag 2022.1 and now i see "parsed" message which looks better (i do not have direct comparison just base on screens what I post here). But Seq still shows "No template provided" is that expected or do I do something wrong? My expectations were probably by default use "message" as "template" or somehow shows it in default list of events.

Sorry for bother you if it is expected result.

{"@t":"2022-05-08T14:36:08.0660000Z","@mt":"No template provided","@m":"No template provided","@i":"2afd9744","message":"Activated domain object of type Squidex.Domain.Apps.Entities.Schemas.DomainObject.SchemaDomainObject with ID 2a88849e-4582-4606-83bc-52102cbd6544--8405fd6a-f63d-4d15-b90d-840c955895e4 in 3.","web":{"requestId":"00-f9b7f2cb3c0418b380b55d5c39c85e62-35e1ea2d1ca4f72d-00","requestMethod":"GET","requestPath":"/api/content/flightics-1/footer/","routeValues":{"action":"GetContents","area":"api","controller":"Contents"}},"type":"Squidex.Domain.Apps.Entities.Schemas.DomainObject.SchemaDomainObject","logLevel":"Information","image_name":"squidex/squidex:6.7.0@sha256:b315c4c8d8b7fe1ab98d4d0c11609c694d8d671e2fda2e5ff5166833f89c0533","timestamp":"2022-05-08T14:36:08Z","category":"Squidex.Domain.Apps.Entities.Schemas.DomainObject.SchemaDomainObject","command":"dotnet Squidex.dll","container_id":"cb3b396c6d3cbd1669d2505eb79d706072eb9346056a153448b6cacc7bd6683b","container_name":"squidex_squidex.1.vpw0nerhbafptbbnl291alo9u","tag":"cb3b396c6d3c","host":"server-1","time":"3","created":"2022-04-25T08:24:13.349455436Z","image_id":"sha256:b9d4d8828e1b87aa1bd81457c688572d1151c66efaba7ea93d29b9ea720f5fe0","app":{"name":"Squidex","sessionId":"7a8fe1b9-e7b8-4309-86da-02f9433adc70","version":"6.7.0.0"}}

from seq-input-gelf.

Hi @jirisykora83 would it be possible to include the raw payload for some of those events again? The scheme we have finds exactly a property called msg or message in the JSON-encoded short_message property and includes it if there isn't a @m or @mt already.

from seq-input-gelf.

@KodrAus I may find where issue was, I upgrade docker image with seq itself but i don't manually update Seq.Input.Gelf nuget inside settings. Currently I am on The version to update to in dotted format. Installed version is 2.0.343.

Not sure if I can get raw payload from seq itself? This is payload what is in seq under raw_payload (after upgrading nuget) I do not know if it is what you need?

{
  "version": "1.1",
  "host": "server-1",
  "short_message": "{\"logLevel\":\"Information\",\"message\":\"Start processing HTTP request GET https://raw.githubusercontent.com/Squidex/templates/main/README.md\",\"eventId\":{\"id\":100,\"name\":\"RequestPipelineStart\"},\"httpMethod\":\"GET\",\"uri\":\"https://raw.githubusercontent.com/Squidex/templates/main/README.md\",\"timestamp\":\"2022-05-10T08:59:24Z\",\"app\":{\"name\":\"Squidex\",\"version\":\"6.7.0.0\",\"sessionId\":\"7a8fe1b9-e7b8-4309-86da-02f9433adc70\"},\"web\":{\"requestId\":\"00-8090c12724486a7a00e2ee97e117f602-ed1e3113951eddb9-01\",\"requestPath\":\"/api/templates\",\"requestMethod\":\"GET\",\"routeValues\":{\"area\":\"api\",\"action\":\"GetTemplates\",\"controller\":\"Templates\"}},\"category\":\"System.Net.Http.HttpClient.Default.LogicalHandler\"}",
  "timestamp": 1652173164.713,
  "level": 6,
  "_command": "dotnet Squidex.dll",
  "_container_id": "cb3b396c6d3cbd1669d2505eb79d706072eb9346056a153448b6cacc7bd6683b",
  "_container_name": "squidex_squidex.1.vpw0nerhbafptbbnl291alo9u",
  "_created": "2022-04-25T08:24:13.349455436Z",
  "_image_id": "sha256:b9d4d8828e1b87aa1bd81457c688572d1151c66efaba7ea93d29b9ea720f5fe0",
  "_image_name": "squidex/squidex:6.7.0@sha256:b315c4c8d8b7fe1ab98d4d0c11609c694d8d671e2fda2e5ff5166833f89c0533",
  "_tag": "cb3b396c6d3c"
}

To me it looks like it works nicely.

from seq-input-gelf.