GELF Specification clarification about graylog2-server HOT 9 CLOSED

Length of uncompressed chunked GELF message is 12 bytes. Looks like a bug in comment. Lennart?

from graylog2-server.

Hello AlekSi,

Okay but the here's code from GELF.java:

public static final int GELF_HEADER_LENGTH = 38;

byte[] rawGELFHeader = new byte[GELF.GELF_HEADER_LENGTH];
for (int i = 0; i < GELF.GELF_HEADER_LENGTH; i++)  {
     rawGELFHeader[i] = message.getData()[i];
}

// Make sure that GELF header begins with 30,15 (<3 Boris Erdmann)
if (rawGELFHeader[0] != 30 || rawGELFHeader[1] != 15) {
    throw new InvalidGELFHeaderException("Invalid GELF ID.");
}

To me it looks like 38 bytes of GELF header or probably I'm missing something.

A.

from graylog2-server.

I'm in the office right now, but will take a look at this later. Thanks so far!

from graylog2-server.

I researched this and can remember talking about this with Aleksi. Aleksi, is the GELF gem currently using the 12bytes header? The server is definitely still using the 38 byte spec:

public static final int HEADER_PART_SEQCNT_START = 36;
public static final int HEADER_PART_SEQCNT_LENGTH = 2;

Thanks for reporting this, t0xa!

from graylog2-server.

Hello Lennart,

Thanks for clarification. Could you please advice on a implementation then. Should I create an implementation based on 38 bytes header?

For the safe side could you please confirm flow for the chunked GELF in general?

1. GZIP long message
2. If gzipped message is larger that 1420 bytes (1500 MTU - 28 bytes UDP header = 1472 bytes) 1472 - 12 bytes GELF header which leaves us 1460 bytes of payload. So we split gizpped message in 1460 bytes pieces
3. Creating the datagram consisted of GELF header + message piece
4. Send via UDP to Graylog server

Thanks a lot for doing great job!

from graylog2-server.

Please use the 38 bytes header for now as this will be working with the current graylog2-server. I'll keep you up to date on when and if to change to the 12 bytes.

Your flow sounds good. (If using 38, not 12 bytes)

from graylog2-server.

Thanks a lot! Maybe it's a good idea to mention the 38 byte business in the GELF Wiki and close this issue?

Anton

from graylog2-server.

Yepp but I'll talk with Aleksi about this first as we already has a discussion on this. :)

from graylog2-server.

This has been clarified in the mean time - You should have received an email today. The GELF documentation is correct now, the server follows it.

from graylog2-server.