bhuvan-somisetty opened a new issue, #14011:
URL: https://github.com/apache/apisix/issues/14011
### Current Behavior
In `apisix/plugins/splunk-hec-logging.lua`, the `send_to_splunk` function
handles non-200 responses from the Splunk HEC endpoint as follows:
```lua
if res.status ~= 200 then
local body = core.json.decode(res.body)
if not body then
return false, "failed to send splunk, http status code: " ..
res.status
else
return false, "failed to send splunk, " .. body.text
end
end
```
When Splunk HEC (or any intermediate proxy / API gateway / reverse proxy in
front of Splunk, such as an AWS ALB, Kong, Cloudflare, or NGINX ingress)
returns an HTTP error status code (such as 400, 401, 403, 500, or 502) with a
valid JSON payload that does not contain a `text` property (e.g. `{"message":
"Unauthorized"}`, `{"error": "Forbidden"}`, `{"code": 403}`, or `{}`),
`core.json.decode(res.body)` decodes into a Lua table (`body ~= nil`).
In the `else` block, `body.text` evaluates to `nil`, leading to string
concatenation `.. body.text`. This throws an unhandled Lua runtime error:
`attempt to concatenate field 'text' (a nil value)`.
This causes the batch processor background timer/worker to crash instead of
cleanly returning `false, err` to handle retries and error logging.
Additionally, in `send_to_splunk`:
```lua
local t = {}
for _, e in ipairs(entries) do
table_insert(t, core.json.encode(e))
end
```
If `core.json.encode(e)` fails for any entry, it returns `nil, err` and
inserts `nil` into `t`, resulting in corrupted batch payloads or issues on
`table_concat(t)`.
### Expected Behavior
`send_to_splunk` should safely handle non-200 JSON responses where
`body.text` is not present, falling back to other common error fields (like
`body.message` or `res.body` or status code), rather than crashing with
`attempt to concatenate field 'text' (a nil value)`.
### Error Logs
```text
2026/10/07 08:30:00 [error] 51234#51234: *123456 [lua]
batch-processor.lua:105: ...x/plugins/splunk-hec-logging.lua:177: attempt to
concatenate field 'text' (a nil value), context: ngx.timer
stack traceback:
...x/plugins/splunk-hec-logging.lua:177: in function 'send_to_splunk'
.../apisix/utils/batch-processor.lua:100: in function 'batch_processor'
```
### Steps to Reproduce
1. Configure a route with the `splunk-hec-logging` plugin pointing to an
endpoint that returns an error status code with JSON missing `text`, for
example HTTP 401 `{"message": "Unauthorized"}` or HTTP 403 `{"error":
"Forbidden"}`.
2. Send requests through the route to generate log entries.
3. When the batch processor flushes the batch to Splunk, observe the error
log: `attempt to concatenate field 'text' (a nil value)`.
### Environment
- APISIX version (run `apisix version`): master (3.19.0)
- Operating system (run `uname -a`): Linux 5.15.0-generic x86_64
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
openresty/1.25.3.1
- etcd version, if relevant (run `curl
http://127.0.0.1:9090/v1/server_info`): 3.5.11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
