-
Notifications
You must be signed in to change notification settings - Fork 118
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Problem UDP as input #43
Comments
Are you using the correct logstash configuration?
|
@isotnikov Take a look at the code in formatter.rb:21: if data.is_a?(String) && data.start_with?('{')
data = (JSON.parse(message) rescue nil) || message
end This means that if |
@isotnikov After a closer look, I see what you meant about two JSON strings on one line. |
@sinaei @isotnikov The |
After some more research, I think this may be a bug in logstash. The logstash UDP listener reads a fixed number of bytes at a time into a buffer, queues up the buffers, and decodes each chunk of bytes one at a time. If the end of one log message just happens to coincide with the end of a buffer, it's possible that logstash codec is combining two log messages into one. The LogStash JsonLines codec also has a fallback when JSON fails to parse: def decode(data)
@lines.decode(data) do |event|
begin
yield LogStash::Event.new(JSON.parse(event["message"]))
rescue JSON::ParserError => e
@logger.info("JSON parse failure. Falling back to plain-text", :error => e, :data => data)
yield LogStash::Event.new("message" => event["message"])
end
end
end You might try checking the log file for your logstash listener. |
Yes, also I have read about it, and think that UDP reads a fixed number of bytes, TCP is not like this, |
Closing, since this appears to be a bug in the logstash listener implementation, and it's not possible to fix this from LogStashLogger. |
I added a note to the readme about this problem in the troubleshooting section. |
Hi,
i am using logstash but I face a problem that is related to UDP input
it can not split the line as input, so my message contains of multiline messages not one line message.
The text was updated successfully, but these errors were encountered: