Flume
  1. Flume
  2. FLUME-1365

Flume-ng with syslog events break with certain characters in message body

    Details

    • Type: Bug Bug
    • Status: Open
    • Priority: Major Major
    • Resolution: Unresolved
    • Affects Version/s: v1.1.0
    • Fix Version/s: None
    • Component/s: Sinks+Sources
    • Labels:
      None
    • Environment:

      Description

      When syslog messages contain hyphens separated by whitespace, flume fails to parse and create valid events. For example, I send three the messages to syslog:

      [root@proxy1 varoun.p]# logger -i -p local1.notice 'foo bar' [root@proxy1 varoun.p]# logger -i -p local1.notice 'foo – bar'
      [root@proxy1 varoun.p]# logger -i -p local1.notice 'foo - - bar'
      [root@proxy1 varoun.p]#

      The corresponding events created by flume are:

      2012-07-11 13:17:17,558 INFO sink.LoggerSink: Event: { headers:

      {timestamp=1342012635000, Severity=5, host=proxy1, Facility=136}

      body: 76 61 72 6F 75 6E 2E 70 5B 31 33 32 38 35 5D 3A varoun.p[13285]: }
      2012-07-11 13:17:19,264 INFO sink.LoggerSink: Event: { headers:

      {timestamp=1342012639000, Severity=5, host=proxy1, Facility=136}

      body: 76 61 72 6F 75 6E 2E 70 5B 31 33 32 38 36 5D 3A varoun.p[13286]: }
      2012-07-11 13:17:23,265 INFO sink.LoggerSink: Event: { headers:

      {Severity=5, Facility=136}

      body: 62 61 72 bar }

      As you can see, the last message results in a broken flume event.

        Issue Links

          Activity

          Hide
          Ashish Paliwal added a comment -

          Modified TestSyslogTcpSource to add data like as "foo – bar - hyphen_null_breaks_5424_pattern", the events details were as expected. Event body contained complete data string, as specified.

          IMHO, we can resolve this issue as duplicate of FLUME-1277. Anyone has feedback on this?

          Show
          Ashish Paliwal added a comment - Modified TestSyslogTcpSource to add data like as "foo – bar - hyphen_null_breaks_5424_pattern", the events details were as expected. Event body contained complete data string, as specified. IMHO, we can resolve this issue as duplicate of FLUME-1277 . Anyone has feedback on this?
          Hide
          Ashish Paliwal added a comment -

          This seems to have been fixed as part of FLUME-1277. Shall verify and resolve it accordingly

          Show
          Ashish Paliwal added a comment - This seems to have been fixed as part of FLUME-1277 . Shall verify and resolve it accordingly
          Hide
          Josh West added a comment -

          Seems like the same issue.

          Show
          Josh West added a comment - Seems like the same issue.

            People

            • Assignee:
              Ashish Paliwal
              Reporter:
              Varoun P
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:

                Development