fluentd: JSON parser swallowing messages without any indication of errors

Check CONTRIBUTING guideline first and here is the list to help us investigate the problem.

  • fluentd or td-agent version.

google-fluentd version 1.5.30-1

  • Environment information, e.g. OS.

Ubuntu 16.04.4 LTS

  • Your configuration
<filter us-west-2.eng.default.docker.**>
  @type parser
  <parse>
    @type multi_format
    <pattern>
      format json
    </pattern>
    <pattern>
      format none
    </pattern>
  </parse>
  key_name log
  reserve_data true
</filter>
  • Your problem explanation. If you have an error logs, write it together.

Some JSON messages are not coming through when using format json Here is the json spitting from the application:

{"name":"db-setup","role":"dev-center-api","serviceVersion":"1.0.20","func":"db-setup","hostname":"300e017400ee","pid":1,"level":30,"type":"read","host":"eng-ide-devcenter-23cef02b4cb6.cv0su2inxpma.us-west-2.rds.amazonaws.com","msg":"Using database server { ts: '2018-07-16T16:34:00.061Z', logLevel: 'info' }","time":"2018-07-16T16:34:00.061Z","v":0}

If there was no parse json, i can see my message in stack driver. But when i use parse json - i dont see anything come through. I can jq my json fine - so it is a legal json.

Since the json parse plugin does not show me any errors, it is hard to troubleshoot when we change something in the JSON and logs start to disappear all of a sudden. Is it possible to record ParseExceptions in fluentd logs so we know about failures?

About this issue

  • Original URL
  • State: closed
  • Created 6 years ago
  • Comments: 15 (5 by maintainers)

Most upvoted comments

Had exactly the same issue here. FYI, if your json parser doesn’t have the correct time format, it will default to time zero (1970), and it will be seamlessly rejected by stackdriver.

Best way to debug this is to change the output from StackDriver to stdout and make sure the time is correctly parsed.

Here is my filter that made it work:

<filter gce-nginx-ingress.**>
  @type parser
  <parse>
    @type multi_format
    <pattern>
      format json
      time_key time
      time_format %d/%b/%Y:%H:%M:%S %z
    </pattern>
    <pattern>
      format none
    </pattern>
  </parse>
  key_name log
  reserve_data true
</filter>