Send echo message to graylog2 via GELF TCP 12201 port
It seems that GELF TCP input needs a null character at the end of each Gelf message.
So you should send:
echo -e '{"version": "1.1","host":"example.org","short_message":"Short message","full_message":"Backtrace here\n\nmore stuff","level":1,"_user_id":9001,"_some_info":"foo","_some_env_var":"bar"}\0' | nc -w 1 my.graylog.server 12201
This answer was found in a discussion on Graylog's issues.
As I was trying to verify that a Logstash instance was correctly listening for GELF inputs, I've found this thread.
Here is a command that will work for Logstash + Gelf over UDP :
echo '{"version": "1.1","host":"example.org","short_message":"A short message that helps you identify what is going on","full_message":"Backtrace here\n\nmore stuff","level":1,"_user_id":9001,"_some_info":"foo","_some_env_var":"bar"}' | gzip | nc -u -w 1 127.0.0.1 12201
Notice that :
- a simple
echois enough, no need for-e - the message is gziped, otherwise you'll get this error :
Could not find parser for header: [123, 34]in Logstash logs - netcat is sending over UDP