[azure-evenhub input] fail to process AppServicePlatformLogs due to unescaped newlines

[zmoog]

• Version: any
• Operating System: any

Some events from the AppServicePlatformLogs log category can contain one or more newline characters (\n).

Here's an example received export from a Diagnostic Setting to an Event Hub:

"{\"records\": [{ \"time\": \"2022-12-17T20:21:24.4331338Z\", \n \"resourceId\": \"/SUBSCRIPTIONS/5AEB8557-CAB7-41AC-8603-9F94AD233EFC/RESOURCEGROUPS/GT-WEU-GTP-CORE-DEV-RSG/PROVIDERS/MICROSOFT.WEB/SITES/AppService-Redacted\", \"category\": \"AppServicePlatformLogs\", \"operationName\": \"AutoHealingLogEvent\", \"level\": \"Informational\", \"resultDescription\": \"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\\n\", \"properties\": {\"message\":\"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\n\"}}]}"

The message attribute contains a \n in this example.

Then this string is unmarshaled, we get an error:

package main

import (
	"encoding/json"
	"fmt"
)

func main() {
	var mapObject map[string][]interface{}
	message := "{\"records\": [{ \"time\": \"2022-12-17T20:21:24.4331338Z\", \n \"resourceId\": \"/SUBSCRIPTIONS/5AEB8557-CAB7-41AC-8603-9F94AD233EFC/RESOURCEGROUPS/GT-WEU-GTP-CORE-DEV-RSG/PROVIDERS/MICROSOFT.WEB/SITES/AppService-Redacted\", \"category\": \"AppServicePlatformLogs\", \"operationName\": \"AutoHealingLogEvent\", \"level\": \"Informational\", \"resultDescription\": \"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\\n\", \"properties\": {\"message\":\"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\n\"}}]}"

	bMessage := []byte(message)
	err := json.Unmarshal(bMessage, &mapObject)
	if err != nil {
		fmt.Println(err)
                return
	}

	fmt.Println(mapObject)
}

The result is:

invalid character '\n' in string literal

[zmoog]

In general, the azure-eventhub input may have an issue handling event hub message payloads that are not strings containing well-formed JSON documents.