Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

json logging can log duplicate message fields #14335

Closed
robbavey opened this issue Jul 7, 2022 · 0 comments · Fixed by #15969
Closed

json logging can log duplicate message fields #14335

robbavey opened this issue Jul 7, 2022 · 0 comments · Fixed by #15969
Assignees

Comments

@robbavey
Copy link
Member

robbavey commented Jul 7, 2022

Description of the problem including expected versus actual behavior:

When using json logging, certain events are logged with two message entries:

{
  "level" : "WARN",
  "loggerName" : "logstash.codecs.jsonlines",
  "timeMillis" : 1657218530687,
  "thread" : "[main]<stdin",
  "logEvent" : {
    "message" : "JSON parse error, original data now in message field",
    "message" : "Unrecognized token 'asd': was expecting (JSON String, Number, Array, Object or token 'null', 'true' or 'false')\n at [Source: (String)\"asd\"; line: 1, column: 4]",
    "exception" : {
      "metaClass" : {
        "metaClass" : {
          "exception" : "LogStash::Json::ParserError",
          "data" : "asd"
        }
      }
    }
  }
}

While this is technically valid json, in reality this will likely cause issues with consumers of the data leading to one of the message values being discarded or being flagged as invalid json.

Steps to reproduce:

This can be triggered by causing a log event of any logger invocation that includes a value for :message in a details hash/varargs, eg this warning entry in the json codec or this helper method in the elasticsearch output

Each of these values is placed directly in the logEvent method at the top level, leading to duplicates when :message is set.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants