External syslog servers adds `#011` strings to log lines when received from OpenShift Logging.
Issue
When using Openshift Logging
to forward logs to an external syslog
server, the tab
character is parsed as #011
string literal.
Nov 19 13:48:56 pod-name fluentd: docker:{"container_id"=>"xxxxxxxxxxxxxxxxxxxxxxxxxx"}#011kubernetes:{"container_name"=>"alert-slave", "namespace_name"=>"alert", "pod_name"=>"alerta-slave-xxxxxx", "container_image"=>"server.fq.dn:8082/alert-oc:xxxxxx", "container_image_id"=>"server.fq.dn:8082/alert-oc@sha256:yyyyyyyyyyyyyyyyyyyyyyyyyyy", "pod_id"=>"UUID-xxxxxxxxxxxxxxxxxxx", "pod_ip"=>"xx.xx.xx.xx", "host"=>"host-fq-dn", "labels"=>{"app"=>"alert", "pod-template-hash"=>"xxxxxxxxxxx", "role"=>"slave"}, "master_url"=>"https://kubernetes-host.default.svc", "namespace_id"=>"xxxxxxxxxxxxxxxxxxxx", "namespace_labels"=>{"argocd_argoproj_io/managed-by"=>"ops-argocd", "kubernetes_io/metadata_name"=>"alert", "openshift-pipelines_tekton_dev/namespace-reconcile-version"=>"vx.y", "openshift_io/cluster-monitoring"=>"true"}}#011message:#011level:unknown#011hostname:hostname-fq-dn#011pipeline_metadata:{"collector"=>{"ipaddr4"=>"xx.xx.xx.xx", "inputname"=>"fluent-plugin-systemd", "name"=>"fluentd", "received_at"=>"2021-11-19T13:48:55.208334+00:00", "version"=>"1.7.4 1.6.0"}}#011@timestamp:2021-11-19T13:48:55.084894+00:00#011viaq_index_name:app-write#011viaq_msg_id:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX#011log_type:application
Environment
- Red Hat Openshift Container Platform [OCP] 4.x
- Red Hat OpenShift Logging.
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.