Skip to content

[azure-evenhub input] fail to process AppServicePlatformLogs due to unescaped newlines #34092

@zmoog

Description

@zmoog
  • Version: any
  • Operating System: any

Some events from the AppServicePlatformLogs log category can contain one or more newline characters (\n).

Here's an example received export from a Diagnostic Setting to an Event Hub:

"{\"records\": [{ \"time\": \"2022-12-17T20:21:24.4331338Z\", \n \"resourceId\": \"/SUBSCRIPTIONS/5AEB8557-CAB7-41AC-8603-9F94AD233EFC/RESOURCEGROUPS/GT-WEU-GTP-CORE-DEV-RSG/PROVIDERS/MICROSOFT.WEB/SITES/AppService-Redacted\", \"category\": \"AppServicePlatformLogs\", \"operationName\": \"AutoHealingLogEvent\", \"level\": \"Informational\", \"resultDescription\": \"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\\n\", \"properties\": {\"message\":\"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\n\"}}]}"

The message attribute contains a \n in this example.

Then this string is unmarshaled, we get an error:

package main

import (
	"encoding/json"
	"fmt"
)

func main() {
	var mapObject map[string][]interface{}
	message := "{\"records\": [{ \"time\": \"2022-12-17T20:21:24.4331338Z\", \n \"resourceId\": \"/SUBSCRIPTIONS/5AEB8557-CAB7-41AC-8603-9F94AD233EFC/RESOURCEGROUPS/GT-WEU-GTP-CORE-DEV-RSG/PROVIDERS/MICROSOFT.WEB/SITES/AppService-Redacted\", \"category\": \"AppServicePlatformLogs\", \"operationName\": \"AutoHealingLogEvent\", \"level\": \"Informational\", \"resultDescription\": \"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\\n\", \"properties\": {\"message\":\"Worker Process serving application pool 'AppService-Redacted' hit the 'Total Requests' limit.\n\"}}]}"

	bMessage := []byte(message)
	err := json.Unmarshal(bMessage, &mapObject)
	if err != nil {
		fmt.Println(err)
                return
	}

	fmt.Println(mapObject)
}

The result is:

invalid character '\n' in string literal

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions