Syslog ingestion Json::ParserError: Unexpected character ('<' (code 60)): expected a valid value (JSON String, Number, Array, Object or token 'null', 'true' or 'false')

Products

• DX Operational Observability

Issue/Introduction

I need to send raw syslog data from multiple spectrum servers to a Central rsyslog which then decorate the data with dxo2 tenant information and forward it to the LogCollector for data ingestion to dxo2. I have Enabled Centralized Syslog Collection for Network Devices with Rsyslog as per below diagram however, in the logcollector log I see the below ParserError:

 

WARN ][logstash.filters.json    ][main][] Error parsing json {:source=>"message", :raw=>"<134>1 2025-07-29T10:10:55Z TCP 0-PPE-6 - - default CONN_TERMINATE 16346169 0 :  Source 10. - Destination 1 - Start Time 07/29/2025:10:10:53 GMT - End Time 07/29/2025:10:10:55 GMT - Total_bytes_send 0 - Total_bytes_recv 1  ", :exception=>#<LogStash::Json::ParserError: Unexpected character ('<' (code 60)): expected a valid value (JSON String, Number, Array, Object or token 'null', 'true' or 'false')

 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 2]>}

 

 

What could be the issue?

Environment

DX On-premise

Cause

Incorrectly configuration of Servers syslog, they were sending data to the "Log Collector" instead to the "Central syslog server" hence the ParsingError.

Resolution

Update the Servers rsyslog port configuration. Contact your Application Team.