2016-02-23 16:09 GMT+01:00 Joe Blow <[email protected]>: > Correct. I get things like this in my omelasticsearch error log: > > "error": "MapperParsingException[failed to parse [csuriquery]]; > nested: JsonParseException[Invalid UTF-8 start byte 0x80\n at [Source: > [B@2210517d; line: 1, column: 450]] > > Then within the normalized JSON i see my <80> tags at that line. > > Any ideas?
I have checked RFC7159 once again, and "<>" is a perfectly valid JSON value. There are also no rules where they recommend to escape "<". On the other hand, this reminds me of the old style <0a> representation of chacracters. Maybe someone from ES got "historical feelings" and implemented this as yet another JSON violation? ;) Anyhow, I think it would be a good idea to ask the ES folks if they have an issue with these characters and why. Once we know, we may find a way out of it... Please report back in any case. Rainer > > Cheers, > > JB > > On Tue, Feb 23, 2016 at 9:33 AM, Rainer Gerhards <[email protected]> > wrote: > >> 2016-02-23 15:29 GMT+01:00 Joe Blow <[email protected]>: >> > Hey all, >> > >> > I've got some logs which might have different languages in them, and it >> > appears that things like this are tripping up when i try and send them to >> > elasticsearch: >> > >> > KEDANOVA%20FA<80>ANES&sec=08& >> > >> > Specifically the <80>. What is the best way to escape both the < and >> the > >> > in the normalized field? I'm already specifying the format as JSON, so >> > backslashes are being escaped properly. Any ideas? >> >> I am not aware that <> need to be escaped. Maybe another ES JSON >> incompatibility? >> >> Rainer >> > >> > Thanks in advance. >> > >> > Cheers, >> > >> > JB >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
