Vector overwrites the log_type when writing a message to syslog that includes its own log_type field in RHOL
Issue
- A log message produced by an application that contains
log_type: openshift_auditis labelled by the collector asauditlog type instead ofapplication - Log messages forwarded to syslog by Vector are incorrectly forwarded as
audit_logmessages when original log line includes alog_typefield - When a log produced contains the
log_typefield in the message, thelog_typefrom the original log overwrites the expectedlog_typevalue that the Vector collector sets
Environment
- Red Hat OpenShift Container Platform (RHOCP) 4
- Red Hat OpenShift Logging (RHOL)
- 5.8.19 and higher
- 5.9.12 and higher
- 6.0
- 6.1
- 6.2
- 6.3
- Vector configured to forward logs to syslog
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.