Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

systemd input message corrupted #9862

Open
ddhuyvetter-godaddy opened this issue Jan 22, 2025 · 1 comment
Open

systemd input message corrupted #9862

ddhuyvetter-godaddy opened this issue Jan 22, 2025 · 1 comment

Comments

@ddhuyvetter-godaddy
Copy link

Bug Report

Describe the bug
starting with fluent-bit 3.2.3 systemd input has extra characters at the end of the MESSAGE field causing json parser filter to fail.

To Reproduce

logging from docker in json format and docker configured to send logs to journald

[SERVICE]
    flush        1
    log_level    info
    parsers_file /etc/fluent-bit/parsers.conf

[INPUT]
    name systemd
    systemd_filter_type and
    systemd_filter _SYSTEMD_UNIT=docker.service
    systemd_filter PRIORITY=6
    systemd_filter CONTAINER_NAME=my-container

[FILTER]
    name parser
    match *
    key_name MESSAGE
    parser json

[OUTPUT]
    name stdout
    match *
  • Steps to reproduce the problem:

run fluent-bit with the above configuration

The output is the full verbose record from systemd, not just the MESSAGE value. (the filter has no effect)
Inspect the MESSAGE in the output and see the full expected json message, followed by additional characters (looks like buffer re-use without clearing). the MESSAGE is unparsed

Expected behavior

The output should be just the MESSAGE from the input parsed as json (verified in version 3.2.2)

Your Environment

  • Version used: 3.2.4
  • Configuration: see above
  • Environment name and version (e.g. Kubernetes? What version?):
  • Server type and version:
  • Operating System and version: alma linux 9
  • Filters and plugins: parser

Additional context

@bpetermannS11
Copy link
Contributor

this is probably a duplicate of #9788 and #9790, fixed with #9789

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants