Fix HTTP POST 2, now json-escaping all strings replaced by the jinja2 template #898
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
For HTTP POST 2, now json-escaping all strings replaced by the jinja2 template in the json which otherwise leads to a syntax error in the json which will not deserialize properly. See #896 for more details on what was happening.
Will it break anything? Before the fix, if a matched event's value contained a newline (or any other control chars that json escapes) and if that value was included in the jinja2 template, the json of the post body could not be generated, because it would internally attempt to deserialize a now-invalid json string.
If anyone else in the field had encountered this problem, they may have worked around it by including already-escaped values before sending into elastic search (which would affect any other downstream processors of the event, needing to know to undo that hack to the value). This fix should address the internal-processing problem in elastalert once and for all, but users would need to read the changelog and stop doing their work-around as they upgrade.
Checklist
make test-docker
with my changes.Questions or Comments
No changes needed to docs necessary.