logstash-logger
logstash-logger copied to clipboard
logs sending, but greylog failing to parse do to not being compressed
My logstash-logger
and lograge
setup:
config.logstash.uri = ENV.fetch("LOGSTASH_ORIGIN")
config.logstash.formatter = :json
config.lograge.enabled = true
config.lograge.base_controller_class = ["ActionController::API", "ActionController::Base"]
config.lograge.formatter = Lograge::Formatters::Logstash.new
config.lograge.custom_payload do |event|
{
host: event.request&.host,
session_id: event.request&.cookie_jar.encrypted[config.session_options.fetch(:key)]&.fetch("session_id"),
remote_ip: event.request&.remote_ip,
context_id: event.request&.request_id,
params: event.params.except("controller", "action", "format", "id")
}.transform_values(&:presence).compact
end
Here's what logstash say:
logstash_1 | [2018-11-26T23:28:20,771][WARN ][logstash.inputs.gelf ] Gelfd failed to parse a message skipping {:exception=>#<Gelfd::UnknownHeaderError: Could not find parser for header: [123, 34]>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/gelfd-0.2.0/lib/gelfd/parser.rb:14:in `parse'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-gelf-3.1.1/lib/logstash/inputs/gelf.rb:212:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-gelf-3.1.1/lib/logstash/inputs/gelf.rb:93:in `block in run'"]}
Apparently according to a google search, this is related to logstash expecting gelf to receive a compression (gzip).