Incorrect Backslash Escaping in Array Elements in GELF Output #9638
Description
Bug Report
Describe the bug
When processing log messages containing strings with backslashes (\) inside arrays using Fluent Bit’s GELF output plugin, the backslashes are incorrectly converted into single backslashes (). This leads to malformed log messages in Graylog, causing errors or unexpected behavior due to the incorrect formatting of the message field.
To Reproduce
Example log message:
2024-11-22T16:28:55.518280367+03:00 stdout F {"message":[{"class":"Test\\Test"}]}
Output in Graylog:
{"version":"1.1", "short_message":"class=Test\Test", "_time":"2024-11-22T16:28:55.518280367+03:00", "_stream":"stdout", "__p":"F", "timestamp":1732282135.518}
Steps to reproduce the problem:
- Configure Fluent Bit with the GELF output plugin.
- Send a log message containing double backslashes (\) in a string field.
- Observe the output in Graylog where double backslashes are incorrectly replaced with single backslashes.
Expected behavior
Double backslashes (\) in the input message should be preserved in the output.
Your Environment
- Version used: 3.2.0
- Configuration:
[SERVICE]
Flush 1
Log_Level info
Daemon off
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
parsers_file /fluent-bit/etc/parsers.conf
[INPUT]
Name tail
Tag kube.*
Path /var/log/containers/*.log
multiline.parser cri
Mem_Buf_Limit 50MB
Skip_Long_Lines On
Skip_Empty_Lines On
[FILTER]
Name parser
Match *
Parser json
Key_Name log
Unescape_Key False
Reserve_Data True
Preserve_Key False
[OUTPUT]
Name gelf
Match *
Host graylog.example.com
Port 12201
Mode udp
Gelf_Short_Message_Key message
- Filters and plugins: gelf, tail