Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-1494

Syslog output is serializing json incorrectly

XMLWordPrintable

    • False
    • False
    • NEW
    • NEW
    • Before this update records shipped via syslog would serialize a ruby hash encoding key/value pairs to contain a '=>' character, as well as replace tabs with "#11". This update serializes the message correctly as proper JSON.
    • Logging (Core) - Sprint 203, Logging (Core) - Sprint 206, Logging (Core) - Sprint 207

      Sample syslog output with json parsing enabled, and application logs are also json

      syslog output:
      <15>1 2021-06-24T08:35:01.573850+00:00 functional rec_appname rec_procid rec_msgid - docker:{"container_id"=>"07e20aa7840daae958674bf3bde43d4f67a952c1938af56d786dfcbb1eeacfff"}#011kubernetes:{"container_name"=>"fluentd", "namespace_name"=>"should-take-values-of-appname-procid-messageid--140445-c25c2de6", "pod_name"=>"functional", "container_image"=>"quay.io/openshift-logging/fluentd:latest", "container_image_id"=>"quay.io/openshift-logging/fluentd@sha256:14166ad5c70f7e2c62e761d6e3022bbba6f8193d36a2771434cbeaf4ee638276", "pod_id"=>"6306fdb4-42a9-4f44-bf43-022daa5d7c7d", "host"=>"crc-gm7cm-master-0", "labels"=>{"test-client"=>"true", "testname"=>"functional", "testtype"=>"functional"}, "master_url"=>"https://kubernetes.default.svc", "namespace_id"=>"c644d0ae-9542-43e5-8cd5-654702cb54a5", "namespace_labels"=>{"test-client"=>"true"}}#011message:{"appname_key"=>"rec_appname", "msgcontent"=>"My life is my message", "msgid_key"=>"rec_msgid", "procid_key"=>"rec_procid", "timestamp"=>"2021-02-16 18:55:01"}#011level:unknown#011hostname:crc-gm7cm-master-0#011pipeline_metadata:{"collector"=>{"ipaddr4"=>"10.217.1.98", "inputname"=>"fluent-plugin-systemd", "name"=>"fluentd", "received_at"=>"2021-06-24T08:35:00.669630+00:00", "version"=>"1.7.4 1.6.0"}}#011@timestamp:2013-03-28T14:36:03.243000+00:00#011viaq_index_name:app-write#011viaq_msg_id:YjJiMDVhZTctNTI5ZS00YTEwLTgyNmUtNzVkNzEwYTE1YzRh#011structured:{"appname_key"=>"rec_appname", "msgcontent"=>"My life is my message", "msgid_key"=>"rec_msgid", "procid_key"=>"rec_procid", "timestamp"=>"2021-02-16 18:55:01"}

      There are two fields in the syslog output which contain serialized json. "message" and "structured". Both fields jave value:

      {"appname_key"=>"rec_appname", "msgcontent"=>"My life is my message", "msgid_key"=>"rec_msgid", "procid_key"=>"rec_procid", "timestamp"=>"2021-02-16 18:55:01"}

      The

      =>

      should not be present, it should be

      :

      as per json format.

            vimalkum@redhat.com Vimal Kumar
            vimalkum@redhat.com Vimal Kumar
            Anping Li Anping Li
            Votes:
            1 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: