New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escaped characters U+0000..001F in JSON not dealt with correctly #33

Open
mbert opened this Issue Apr 5, 2018 · 0 comments

Comments

Projects
None yet
1 participant
@mbert

mbert commented Apr 5, 2018

On Kubernetes container logs are formatted as JSON and redirected into log files in /var/log/containers. In this process the characters U+0000..001F are escaped. Hence, a tab character becomes "\u0009" (i.e. a string). This breaks recognition of stacktraces that contain tabs.

For Java the following change to the existing code works:

diff --git a/lib/fluent/plugin/exception_detector.rb b/lib/fluent/plugin/exception_detector.rb
index c83fcab..ed23c49 100644
--- a/lib/fluent/plugin/exception_detector.rb
+++ b/lib/fluent/plugin/exception_detector.rb
@@ -53,9 +53,9 @@ module Fluent
       rule(:start_state,
            /(?:Exception|Error|Throwable|V8 errors stack trace)[:\r\n]/,
            :java),
-      rule(:java, /^[\t ]+(?:eval )?at /, :java),
-      rule(:java, /^[\t ]*(?:Caused by|Suppressed):/, :java),
-      rule(:java, /^[\t ]*... \d+\ more/, :java)
+      rule(:java, /^(\\u0009|[\t ])+(?:eval )?at /, :java),
+      rule(:java, /^(\\u0009|[\t ])*(?:Caused by|Suppressed):/, :java),
+      rule(:java, /^(\\u0009|[\t ])*... \d+\ more/, :java)
     ].freeze
 
     PYTHON_RULES = [

mbert added a commit to mbert/fluent-plugin-detect-exceptions that referenced this issue Jul 23, 2018

Teach exception_detector.rb to deal with escaped tabs (\u0009) in JSO…
…N streams (GoogleCloudPlatform#33: Escaped characters U+0000..001F in JSON not dealt with correctly).

mbert added a commit to mbert/fluent-plugin-detect-exceptions that referenced this issue Jul 23, 2018

Teach exception_detector.rb to deal with escaped tabs (\u0009) in JSO…
…N streams (GoogleCloudPlatform#33: Escaped characters U+0000..001F in JSON not dealt with correctly).

mbert added a commit to mbert/fluent-plugin-detect-exceptions that referenced this issue Jul 23, 2018

Teach exception_detector.rb to deal with escaped tabs (\u0009) in JSO…
…N streams of Java exceptions (GoogleCloudPlatform#33: Escaped characters U+0000..001F in JSON not dealt with correctly).

bobasek added a commit to bobasek/fluent-plugin-detect-exceptions that referenced this issue Oct 31, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment