GelfTcpResponse not inserting "short_message" or "message" (as seen from Graylog GELF receiver machine)

[spaghettidba]

GelfTcpResponse not inserting "short_message" or "message" (as seen from Graylog GELF receiver machine)

[spaghettidba]

Ah, I'm sorry, I know nothing about this.
Hey @awickham10 , can you help please?

[awickham10]

It's been a while since I looked at this code but I believe it puts the "message" field in the XE in the "short_message" field in GELF.

Do you have a "message" field defined in your XE session?

[alago197]

Hi Andrew,

No, there is no "message" (nor "short_message") field in my XE session (see below, attached image, of autocreated fields / tested via a TableAppender too, see my config below):

    "Target": {
        // use a list of servers
        "ServerName": ["XXXXXX"],
        "SessionName": "queries_rpc_hosix5",   
        "FailOnProcessingError": false,
        "Responses": [
            {
                "__type": "TableAppenderResponse",   
                // each server will refer to itself with the {ServerName} placeholder
                // this means that in this case each server will upload the event to itself
                "ServerName": "{ServerName}",
                "DatabaseName": "testalvaro200",
                "TableName": "queriesrpc5",
                "AutoCreateTargetTable": true,   
                "UploadIntervalSeconds": 10    
            },
            {
                "__type": "GelfTcpResponse",
                "ServerName": "XX.XXX.XXX.XXX",
                "Port": "12207",
                "Encrypt": false  // ,
                //  "TrustServerCertificate": true
            },`

[alago197]

Just to clarify, my XE session captures the "rpc_completed" event in SQL Server....I don't have any "message" or "short_message" field in that event (I think that's the problem indeed)

[awickham10]

That probably explains it. It's not currently designed in a way to be able to map XE fields to GELF fields so the XE session must have a message field. It sounds like it won't work for your situation without modifications.

[alago197]

Yes. Finally, I've managed to use the CsvAppender (save to a local file, then send that file/log to Graylog via a normal input stream) for this situation. Anyway, I would like to suggest a "default" insertion of the "message" (or "short_message") field, if there's no such field in the session. Even a dummy "message: content" string would suffice to comply the GELF specs (and as we can see from the capture above, the rest of the fields are present). Feel free to close this issue, of course.