Bug 1734951: rsyslog with MERGE_JSON_LOG=true does not handle non-JSON data #222
Conversation
|
@richm: This pull request references a valid Bugzilla bug. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/valid-bug
openshift-ci-robot
added
size/M
|
/retest |
…N data https://bugzilla.redhat.com/show_bug.cgi?id=1734951 When mmnormalize fails to parse, it will create the fields `originalmsg` and `unparsed-data` in the record: https://github.com/rsyslog/liblognorm/blob/master/src/pdag.c#L1680 In this case, we want to remove the fields from the record, just after where the mmnormalize occurred. This also ensures that the timestamp we use to generate the index name is normalized i.e. make sure it is in the form `YYYY-MM-DD`. If using `MERGE_JSON_LOG=true`, the user may have already added a `@timestamp` field to the record which may be in some odd format.
richm
force-pushed
the
bz173495-rsyslog-with-MERGE_JSON_LOG=true-does-not-handle-non-JSON-data
branch
from
ebf6553 to
6d961b3
Compare
|
/retest |
3 similar comments
|
/retest |
|
/retest |
|
/retest |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: nhosoi, richm The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@richm: All pull requests linked via external trackers have merged. The Bugzilla bug has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
richm
deleted the
bz173495-rsyslog-with-MERGE_JSON_LOG=true-does-not-handle-non-JSON-data
branch
…GE_JSON_LOG=true-does-not-handle-non-JSON-data Bug 1734951: rsyslog with MERGE_JSON_LOG=true does not handle non-JSON data
4 participants
https://bugzilla.redhat.com/show_bug.cgi?id=1734951
When mmnormalize fails to parse, it will create the fields
originalmsgand
unparsed-datain the record:https://github.com/rsyslog/liblognorm/blob/master/src/pdag.c#L1680
In this case, we want to remove the fields from the record, just after
where the mmnormalize occurred.
This also ensures that the timestamp we use to generate the index
name is normalized i.e. make sure it is in the form
YYYY-MM-DD. Ifusing
MERGE_JSON_LOG=true, the user may have already added a@timestampfield to the record which may be in some odd format.