gelf output plugin creates invalid GELF messages from JSON arrays parsed in kubernetes filter

[scne59]

Bug Report

Describe the bug When processing JSON log output that contains arrays where elements are strings with quotes in them the gelf output plugin creates invalid GELF messages.

To Reproduce

• Example log message:

  2024-07-09T08:11:19.507903521+00:00 stderr F {"version": "1.0", "clients": ["\"a\"","'b'","c\n","d"], "string": "this is a \"test\"\n"}

• Steps to reproduce the problem: fluent-bit.conf:

  
  [SERVICE]
  flush        1
  daemon       Off
  log_level    trace
  parsers_file parsers.conf
  plugins_file plugins.conf

[INPUT] name tail tag tail. Parser crio path /path/to/logs/.log

[OUTPUT] Name gelf Match ** Host 127.0.0.1 Port 1444 mode tcp Gelf_Short_Message_Key message

[FILTER] Name kubernetes Match ** Dummy_Meta On Merge_Log On Merge_Log_Key data K8S-Logging.Parser On K8S-Logging.Exclude On Buffer_Size ${K8S_HTTP_BUF_LIMIT}

parsers.conf:

[PARSER] Name crio Format Regex Regex /^(?.+) (?stdout|stderr) (?[FP]) (?.*)$/ Time_Key timestamp_message Time_Format %Y-%m-%dT%H:%M:%S.%L%z Time_Keep On

* start an instance with fluent-bit.conf and parsers.conf locally.
* start a session of `nc -l 1444 -k` to see the GELF output received
* write the example message to a file in /path/to/logs/*.log

In this case the resulting GELF message is

{"version":"1.1", "_stream":"stderr", "_logtag":"F", "_data_string":"this is a \"test\"", "_data_clients":""a", 'b', c , d", "_data_version":"1.0", "_kubernetes_dummy":"Wed Jul 24 18:18:01 2024", "_log":"{\"version\": \"1.0\", \"clients\": [\"\\"a\\"\",\"'b'\",\"c\n\",\"d\"], \"string\": \"this is a \\"test\\"\n\"}", "_timestamp_message":"2024-07-09T08:11:19.507903521+00:00", "short_message":"(no message)", "timestamp":1720512679.507}

which is not valid JSON.

**Expected behavior**
The gelf plugin should quote the meta characters correctly as it does in case of simple string that are not part of an array in order to produce valid GELF/JSON output.

**Your Environment**
* Version used: v2.1.7 but recent main is behaving exectly the same
* Configuration: k8s -> fluent-bit -> Graylog

[github-actions[bot]]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.