fluent / fluent-bit

Fast and Lightweight Logs and Metrics processor for Linux, BSD, OSX and Windows
https://fluentbit.io
Apache License 2.0
5.84k stars 1.58k forks source link

out_loki: no escaping with `key_value` output format #8562

Closed savoiringfaire closed 1 month ago

savoiringfaire commented 7 months ago

Bug Report

Describe the bug I'm using fluent-bit to write to loki with the key_value line_format (which, in my head at least, is equivelent to logfmt and I'm opening this with the assumption that we want to support fluent-bit key_value output being parseable). E.g. the log line tes"t shows up in loki as log="tes"t" rather than log="tes\"t" as I would have expected. As far as I can tell the Grafana fluent-bit plugin does handle this through https://github.com/grafana/loki/blob/main/vendor/github.com/go-logfmt/logfmt/jsonstring.go#L51. Additionally, the jsonstring.go escapes other special characters too.

To Reproduce

Using the config:

pipeline:
  inputs:
    - name: tail
      tag: test
      path: ./test.log
  outputs:
    - name: stdout
      match: '*'
    - name: loki
      match: '*'
      host: -----
      port: 443
      tls: On
      http_user: -----
      http_passwd: -----
      line_format: key_value

and then running echo "tes\"t" >> test.log results in log lines showing up in Loki with log="tes"t"

Expected behavior

The line_format output is correctly parseable by the loki logfmt parser when it has quotes in by escaping any quotes (and possibly other special characters) inside of strings. E.g. the line tes"t in a log file would output log="tes\"t" to align with what the loki logfmt parser is able to parse, and what the Grafana-provided fluent-bit plugin provides.

Your Environment

Additional context

We aren't always in control of the log lines that applications output, so having certain characters completely break our parsing ability for some lines makes it hard to use fluent-bit with the default plugin for our platform. Instead, we're likely going to switch to either the Grafana-provided plugin, or Fluentd. In this particular case the default Apache output format breaks our log messages as it uses quotes.

jcdauchy-moodys commented 4 months ago

I have add the same issue and that's why i sticked to the "Go version of FB loki plugin" :(

github-actions[bot] commented 1 month ago

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.

github-actions[bot] commented 1 month ago

This issue was closed because it has been stalled for 5 days with no activity.