Details
-
Bug
-
Resolution: Done
-
Major
-
Logging 5.0.z
-
False
-
False
-
NEW
-
NEW
-
Before this update records shipped via syslog would serialize a ruby hash encoding key/value pairs to contain a '=>' character, as well as replace tabs with "#11". This update serializes the message correctly as proper JSON.
-
Logging (Core) - Sprint 203, Logging (Core) - Sprint 206, Logging (Core) - Sprint 207
Description
Sample syslog output with json parsing enabled, and application logs are also json
syslog output:
<15>1 2021-06-24T08:35:01.573850+00:00 functional rec_appname rec_procid rec_msgid - docker:{"container_id"=>"07e20aa7840daae958674bf3bde43d4f67a952c1938af56d786dfcbb1eeacfff"}#011kubernetes:{"container_name"=>"fluentd", "namespace_name"=>"should-take-values-of-appname-procid-messageid--140445-c25c2de6", "pod_name"=>"functional", "container_image"=>"quay.io/openshift-logging/fluentd:latest", "container_image_id"=>"quay.io/openshift-logging/fluentd@sha256:14166ad5c70f7e2c62e761d6e3022bbba6f8193d36a2771434cbeaf4ee638276", "pod_id"=>"6306fdb4-42a9-4f44-bf43-022daa5d7c7d", "host"=>"crc-gm7cm-master-0", "labels"=>{"test-client"=>"true", "testname"=>"functional", "testtype"=>"functional"}, "master_url"=>"https://kubernetes.default.svc", "namespace_id"=>"c644d0ae-9542-43e5-8cd5-654702cb54a5", "namespace_labels"=>{"test-client"=>"true"}}#011message:{"appname_key"=>"rec_appname", "msgcontent"=>"My life is my message", "msgid_key"=>"rec_msgid", "procid_key"=>"rec_procid", "timestamp"=>"2021-02-16 18:55:01"}#011level:unknown#011hostname:crc-gm7cm-master-0#011pipeline_metadata:{"collector"=>{"ipaddr4"=>"10.217.1.98", "inputname"=>"fluent-plugin-systemd", "name"=>"fluentd", "received_at"=>"2021-06-24T08:35:00.669630+00:00", "version"=>"1.7.4 1.6.0"}}#011@timestamp:2013-03-28T14:36:03.243000+00:00#011viaq_index_name:app-write#011viaq_msg_id:YjJiMDVhZTctNTI5ZS00YTEwLTgyNmUtNzVkNzEwYTE1YzRh#011structured:{"appname_key"=>"rec_appname", "msgcontent"=>"My life is my message", "msgid_key"=>"rec_msgid", "procid_key"=>"rec_procid", "timestamp"=>"2021-02-16 18:55:01"}
There are two fields in the syslog output which contain serialized json. "message" and "structured". Both fields jave value:
{"appname_key"=>"rec_appname", "msgcontent"=>"My life is my message", "msgid_key"=>"rec_msgid", "procid_key"=>"rec_procid", "timestamp"=>"2021-02-16 18:55:01"}
The
=>
should not be present, it should be
:
as per json format.
Attachments
Issue Links
- is cloned by
-
-
- Closed
-
- links to
