-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
escape hell in_forward or record transformer #1736
Comments
@epcim Could you paste your full configuration? |
First of all I have similar:
seems to me we don't excape
|
This is my config
|
There is ~30% chance that it appears only if |
Some types of errors are found in you log.
Both error 1. and 2. may be caused by messy escaped data. But I could not find the reason that such data incoming. You can insert following snippet to check incoming data :
For example, we want to know that incoming data has already been escaped:
If incoming data has already been broken, you should check your logging driver. |
Sorry , but I don';t see such option https://docs.fluentd.org/v0.12/articles/out_stdout |
Sorry, could you try https://docs.fluentd.org/v0.14/articles/filter_stdout ?
Default configuration is enough to debug, I think. |
For now, I can't reproduce. Will provide you the logs. I have them actually. For now I can say that the escapes probably don't come from in_forward. But are somehow created while processing in fluentd |
I did not manage to reproduce it on latest versions of fluentbit/fluentd and used plugins. |
Fluentd or td-agent version.
td-agent, 0.14.20
Environment information, e.g. OS.
container, k8s, https://github.com/Mirantis/k8s-apps/tree/master/charts/fluentd
Configuration
First, I don't know relation to in_forward, as timestamp attribute, I set later, by the record_transformer plugin. Assuming "timestamp" is native time attribute of fluent interface, this issue can be also related to fluentbit that may do an escaping (I use - 0.12.4) as the record can be broken at source.
Config on fluentd
The "incoming" record got messy in escape hell. We fail somewhere and remove a "t" from timestamp attribute.
On another occurence I see jsut after the above outpout:
full log
The text was updated successfully, but these errors were encountered: