Hi,
We have configured a topic SNS for AWS Config changes, which is bridged to an SQS queue. We do multiple see "messages in flight" on the SQS via the SQS Console. But, the AWS TA input config keep throwing "Unable to parse message." errors in the TA log.
We do see the messages are in json format in the SQS console. We have validated the json message through a validator.
Below are the errors thrown by the TA.
2017-11-16 19:32:57,591 level=CRITICAL pid=19233 tid=Thread-10 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:265 | datainput="US_East_Virginia_Config" start_time=1510860606, created=1510860777.58 message_id="655d6019-1525-4647-8160-8a3584d71c59" ttl=300 job_id=8d332ee6-acbd-4628-960d-4642e08e79a4 | message="An error occurred while processing the message."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 245, in _process
records = self._parse(message)
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 312, in _parse
raise ValueError("Unable to parse message.")
ValueError: Unable to parse message.
Any hints/clues are highly appreciated.
thanks!
↧