logstash - gelf - input

[jordansissel]

(This issue was originally filed by @karthiklml at elastic/logstash#2387)

---

Hi,

I am enabling the GELF input in the logstash and pushing some json code for testing .
Testing scenario is json test input => logstash-shipper => logstash => ES => UI . i am getting the following error . logstash version is 1.4.2

:message=>"Gelfd failed to parse a message skipping", :exception=>#<Gelfd::UnknownHeaderError: Could not find parser for header: [123, 34]>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in parse'", "/opt/logstash/lib/logstash/inputs/gelf.rb:83:inudp_listener'", "/opt/logstash/lib/logstash/inputs/gelf.rb:60:in run'", "/opt/logstash/lib/logstash/pipeline.rb:163:ininputworker'", "/opt/logstash/lib/logstash/pipeline.rb:157:in `start_input'"], :level=>:warn}

Please suggest me what is the root cause of it . and how to fix it .

Thanks

[mathieu-pousse]

Got the same.

This is due to the fact that the library used to parse the gelf payload only accept gzipped payload

To test, you can use this command (note the gzip -c to compress on the fly the payload)

echo -n '{ "version": "1.1", "host": "example.org", "short_message": "A short message", "level": 5, "_some_info": "foo" }' | gzip -c | nc -w 1 -u logstash 12201