So i have configured nxlog with https to talk with logstash. 
I got an error on nxlog side " ERROR unexpected data from server (64 bytes)" 
I looked it up and it looks like nxlog got https://github.com/lamby/pkg-nxlog-ce/blob/master/src/modules/output/http/om_http.c#L6462 

So i did check up the http input on logstash side , but i have not understand it 
Looks like logstash should send respond code, but i dont see it. Remember i dont have ruby skills. 
Can someone explain to me what might be wrong here ? Or how to fix this issue ?

AskedJuly 24, 2015 - 12:36pm

Answer (1)

Can you get a traffic dump to see what logstash sends back to the client side?

Comments (2)

  • Tuxizm's picture

    Yes we have checked the tcpdump. readed the content in wireshark and there is equal amount of responses to the post messages. 

    Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n
    Request Version: HTTP/1.1
    Status Code: 200
    Response Phrase: OK
    Content-Type: text/plain\r\n
    Content-Length: 2\r\n
    Content length: 2

    Although the wireshark shows counting from 2 if it comes to the request. EX. first POST request 2/3 then POST request 3/3 same goes for the http response 2/3 3/3. 

  • bourazaniss's picture

    I have the same error "Unexpected data from server ..." using om_http to send Windows event logs throuhg Nginx to Redis.

    The problem is that when this error happens the service unexpectently stops !

    From the source code I can understand that NXLog receives a response which cannot map to a correnponding request.

    It has a response with an appropriate length but the corresponding request is null!

    The solution could be as simple as to just return from the function in case this happens and not execute the code following the condition that leads the service to crash.