SDATA Malformed Parsing Using Fluentd (4234695)

サポートと今すぐチャット

戻る

フィードバックを送信しました

この記事は課題解決に役立ちましたか?

評価を選択

タイトル

SDATA Malformed Parsing Using Fluentd
説明

When sending logs through Fluentd the parsing becomes malformed and the messages look incorrect.
原因

The template for the parsing of the logs is incorrect and needs to be adjusted for Fluentd specifically.
対策
The following format is expected via Fluentd per Fluentd's website:
https://docs.fluentd.org/parser/syslog
expression /\A^\[0-9]{1,3})\>[1-9]\d{0,2} (?[^ ]+) (?[^ ]+) (?[^ ]+) (?[-0-9]+) (?[^ ]+) (?(\[(.*)\]|[^ ])) (?.+)$\z/
time_format "%Y-%m-%dT%H:%M:%S.%L%z"

The problem is that in the extradata part there exist brackets ( [ ] ) which can cause issues with log formatting.
The following template solves the issue of the malformed message:
```
template('1 $ISODATE $HOST $PROGRAM $PID $MSGID $SDATA \"${MSG}\"\n')
```
Using additional double quotation marks around the ${MSG} the issue is able to be resolved.

フィードバックを送信しました

この記事は課題解決に役立ちましたか?

評価を選択

推奨コンテンツ

製品：: syslog-ng Premium Edition
7.0.30, 7.0.29, 7.0.28, 7.0.27, 7.0.26, 7.0.25, 7.0.24, 7.0.23, 7.0.22, 7.0.21, 7.0.20, 7.0.19, 7.0.18, 7.0.17, 7.0.16, 7.0.14, 7.0.13, 7.0.12, 7.0.11, 7.0.10, 7.0.9, 6.0.17, 6.0.16, 6.0.15, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 7.0.8, 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1; syslog-ng Store Box
6.3.0, 6.2.0, 6.1.0, 6.0.2, 6.0.1, 6.0, 5.3.0, 5.2.0, 5.1.0, 5.0.4, 5.0.3, 5.0.2, 5.0.1, 5

タイトル