[syslog-ng] Syslog-ng + graylog2 destination

[Fabien Wernli]

Hi László,

On Mon, Oct 14, 2019 at 01:58:20PM +0200, László Pál wrote:
> Oct 14 13:53:20 lumberjack syslog-ng[2174]: Casting error; value='', type-hint='int32'

It seems one of the fields you're sending should be an integer, but it's an
empty string instead. If you look at the destination's code, you'll see that
it uses the following format:

    template-function "format-gelf" "$(format-json version='1.1' host='${HOST}' short_message='${MSG}' level=int(${LEVEL_NUM}) timestamp=int64(${R_UNIXTIME}) _program='${PROGRAM}' _pid=int(${PID}) _facility='${FACILITY}' _class='${.classifier.class}' --key .* --key _*)$(binary 0x00)";

I'm suspecting that one of your macros ($LEVEL_NUM or $PID) is empty, due to a problem in syslog-format parsing. It's probably $PID, as the other one is automatically set.

If my theory is correct, try the following workaround:

  destination d_graylog_gelf {
    channel {
      rewrite {
        set("${PID:-0}", value('PID'));
      };
    };
    channel {
      destination {
        graylog2(
          log_fifo_size(500000)
          host("10.72.0.137")
          transport (tcp)
        );
      };
    };
  };

This will set the PID to 0 if unset.