fatihusta opened a new issue, #8276:
URL: https://github.com/apache/apisix/issues/8276
### Current Behavior
```
local function send_syslog_data(conf, log_message, api_ctx)
-- reuse the logger object
local ok, err = logger:log(core.json.encode(log_message))
if not ok then
res = false
err_msg = "failed to log message" .. err
end
return res, err_msg
end
-- called in log phase of APISIX
function _M.push_entry(conf, ctx, entry)
if batch_processor_manager:add_entry(conf, entry) then
return
end
-- Generate a function to be executed by the batch processor
local cp_ctx = core.table.clone(ctx)
local func = function(entries, batch_max_size)
local data, err
if batch_max_size == 1 then
data, err = core.json.encode(entries[1]) -- encode as single {}
else
data, err = core.json.encode(entries) -- encode as array [{}]
end
if not data then
return false, 'error occurred while encoding the data: ' .. err
end
return send_syslog_data(conf, data, cp_ctx)
end
batch_processor_manager:add_entry_to_new_processor(conf, entry, ctx,
func)
end
```
In function `push_entry` log entries are encoded. And these logs are sent
using the `send_syslog_data` function. In `send_syslog_data` function the logs
are again encoded and sent to ` logger:log `function. This causes double
encoding in json and thus, the messages can not be decoded ass json string. In
the following `tcpdump` output we can see the double encoded log:
`"{\"upstream\":\"UPSTREAM_IP:PORT\",\"request_method\":\"GET\",\"engine\":\"APISIX\",\"request_time\":0.033,\"scheme\":\"https\",\"upstream_response_time\":0.033,\"request\":\"GET
\\\/
HTTP\\\/2.0\",\"status\":\"200\",\"upstream_connect_time\":0.033,\"server_port\":\"443\",\"http_user_agent\":\"curl\\\/7.84.0\",\"bytes_sent\":2098,\"service_id\":\"ac75d46e37889437a26d804b8d76f729\",\"time_local\":\"08\\\/Nov\\\/2022:14:38:05
+0300\",\"uri\":\"\\\/\",\"server_protocol\":\"HTTP\\\/2.0\",\"remote_addr\":\"REMOTE_ADDR\",\"server_name\":\"_\",\"remote_port\":\"REMOTE_PORT\",\"http_host\":\"HTTP_HOST\",\"request_length\":41,\"ssl_cipher\":\"ECDHE-RSA-AES256-GCM-SHA384\",\"route_id\":\"ac75d46e37889437a26d804b8d76f729\",\"ssl_protocol\":\"TLSv1.2\",\"request_id\":\"e6beff6a47e3f931fd516beea79ce636\",\"upstream_status\":\"200\"}"`
### Expected Behavior
The logs should be encoded once and the json data should look like this:
`
{"ssl_cipher":"ECDHE-RSA-AES256-GCM-SHA384","status":"200","ssl_protocol":"TLSv1.2","request_id":"a4abeeede6117ca673f8913bd448a896","service_id":"ac75d46e37889437a26d804b8d76f729","server_name":"_","request_method":"GET","engine":"APISIX","http_host":"TARGET_HOST","request":"GET
\/img\/login2.4043f5d8.svg
HTTP\/2.0","upstream_response_time":0.002,"scheme":"https","upstream_status":"200","upstream_connect_time":0,"request_time":0.002,"http_user_agent":"Mozilla\/5.0
(Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko)
Chrome\/107.0.0.0
Safari\/537.36","bytes_sent":33790,"request_length":2672,"time_local":"08\/Nov\/2022:14:38:40
+0300","route_id":"ac75d46e37889437a26d804b8d76f729","server_protocol":"HTTP\/2.0","remote_addr":"REMOTE_ADDR","upstream":"UPSTREAM_IP:PORT","server_port":"PORT","uri":"\/img\/login2.4043f5d8.svg","remote_port":"PORT"}`
### Error Logs
_No response_
### Steps to Reproduce
Enable syslog plugin.
Capture syslog traffic with tcpdump
### Environment
- APISIX version 2.15:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
