Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))

Question

I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages because it's failing to JSON parse them. Example:

com.fasterxml.jackson.core.JsonParseException: Unexpected character ('<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')
  at [Source: (String)"<190>Sep 21 12:53:47 1d9e42d48ece nginx: { .... }

The JSON parse extractor is the very last one and there's an extractor before it to remove anything that might not be JSON (replace ^.*?(\{.*?\})$ with $1) to ensure that this wouldn't happen, but still no go.

graylog extractors screenshot

What else could be causing this?

Answer 1

The content pack creates a GELF input. After switching (export extractors -> import extractors) to a syslog type input the issue went away.