trellix-enterprise / mysql-audit

AUDIT Plugin for MySQL. See wiki and readme for description. If you find the plugin useful, please star us on GitHub. We love stars and it's a great way to show your feedback.
Other
239 stars 57 forks source link

Binary BLOB creating invalid JSON #207

Open ademariag opened 5 years ago

ademariag commented 5 years ago

When the logline contains a binary field, this gets printed out to JSON in a way that it is not compatible with the JSON format.

Logstash, which I use then to read and ship the file, complains with the logline being invalid.

{:timestamp=>"2019-01-04T17:19:23.861000+0000", :message=>"Received an event that has a different character encoding than you configured.", 
[cut] HPatient/39926c569b38f4cec2ba3239ffca8b7c047adde708cff2fb45b5a62f100d4074\\x8A\\\\u0001\\\\t\\\\b\\xC0<U+063F>ā\\xBF\\\\\\\\\\ [cut]q

Would it be possible to detect that a field is not a text field and perhaps encode it to base64 or similar?