Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"emit_unmatched_lines" ommits source_hostname_key or source_address_key #2552

Closed
aeber opened this issue Aug 12, 2019 · 0 comments · Fixed by #2553
Closed

"emit_unmatched_lines" ommits source_hostname_key or source_address_key #2552

aeber opened this issue Aug 12, 2019 · 0 comments · Fixed by #2553
Labels
bug Something isn't working

Comments

@aeber
Copy link
Contributor

aeber commented Aug 12, 2019

Describe the bug
#2499 introduced the option emit_unmatched_lines to the syslog input to keep messages in the pipeline even if parsing fails.
Due to the way this was implemented source_hostname_key or source_address_key do not get included in the emitted message even though this information is provided by the underlying udp/tcp server.

if @emit_unmatched_lines
emit("#{@tag}.unmatched", Fluent::EventTime.now, {"unmatched_line" => data})
end

if @emit_unmatched_lines
emit("#{@tag}.unmatched", Fluent::EventTime.now, {"unmatched_line" => text})
end

if @emit_unmatched_lines
emit("#{@tag}.unmatched", Fluent::EventTime.now, {"unmatched_line" => text})
end

To Reproduce

  • Create syslog input with emit_unmatched_lines true and source_hostname_key source_hostname and inject some unparseable message.
  • the emitted message only contains the key unmatched_line and no source_hostname

Expected behavior
source_hostname_key and source_address_key should be honored even for unmatched lines.

Your Environment

  • Fluentd or td-agent version: fluentd 1.6.3
  • Operating system: Debian 9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant