Feature/issue6 malformed message

splunk / docker-logging-plugin

Splunk Connect for Docker is a Docker logging plugin that allows docker containers to send their logs directly to Splunk Enterprise or a Splunk Cloud deployment.

Apache License 2.0

65 stars 25 forks source link

Feature/issue6 malformed message #8

Closed sharonx closed 6 years ago

sharonx commented 6 years ago

Here malformed message only happens when an event message is an empty string.
The other malformed situation is non utf8 encoded bytes.
- Added more debug messages

dtregonning commented 6 years ago

Thanks for PR @sharonx

All the log additions are good.
Is checking every log message and splicing into a byte[][] the most efficient way to eliminate the event of only spaces issues? Would it better to trigger the check for the malformed message while JSON marshaling and handling there?

sharonx commented 6 years ago

@dtregonning HEC doesn't accept empty string. But empty string is acceptable by JSON as value.

Here I'm trying to decode the message while reading from the fifo. If it is empty, the message is discarded so it won't make it to the json marshal stage.

sharonx commented 6 years ago

@chenziliang thanks for the comments. I updated the PR.