Graylog Input Not Receiving Messages — Quick Fix

In this tutorial, you'll learn about Graylog Input Not Receiving Messages. We cover key concepts, practical examples, and best practices.

The Problem

Graylog inputs are not receiving log messages. The input shows as running in the Graylog web interface, but no messages appear in the stream. Senders report that their logs are being delivered but Graylog does not show them.

Error example:

Input Syslog UDP on port 514: Not receiving any messages
Input Beats on port 5044: No messages in the last hour
Unable to bind to port 514: Permission denied

The Fix

Step 1: Check if the input is actually listening

WRONG — assuming the input shows "running" means it is working:

# "Running" means the thread started, not that messages are flowing

RIGHT — verify the port is listening:

ss -tlnp | grep 514

Output:

udp   UNCONN  0  0  0.0.0.0:514  0.0.0.0:*  users:(("java",pid=1234))

If no output, the input failed to bind. Check Graylog logs:

journalctl -u graylog-server | grep -i input

Step 2: Fix TLS and port binding issues

WRONG — running Graylog as root to bind to privileged ports:

# Running as root is not recommended

RIGHT — configure port forwarding or use a privileged port redirect:

# Use authbind or iptables to redirect privileged ports
# Example: redirect port 514 to 5514
iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to-port 5514

# Then configure the input to listen on 5514
# In Graylog web UI: System -> Inputs -> Edit input
# Set port to 5514

Use DodaTech's Graylog Input Health Checker to monitor input status, message throughput, and error rates across all inputs.

Prevention Tips

• Use ports above 1024 for inputs (avoid privileged port issues)
• Configure TLS termination at a reverse proxy or load balancer
• Monitor input metrics with Graylog's built-in input statistics
• Use separate inputs for different types of logs (syslog, GELF, Beats)
• Use DodaTech's Graylog Deployment Guide for input configuration best practices

Common Mistakes with input error

1. Using return to exit a function early instead of wrapping a pure value in the monad
2. Mixing let bindings with <- bindings in do notation, producing type errors
3. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors

These mistakes appear frequently in real-world GRAYLOG code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

Related: DodaTech's Graylog Log Management Guide covers input types, extractor patterns, and pipeline configuration for centralized log management.