From 5f6d6a5093a4db799f9c1a6bb82eed1eea13ec0c Mon Sep 17 00:00:00 2001 From: Florian Noeding Date: Mon, 14 Aug 2017 18:27:51 +0200 Subject: [PATCH] Fixed `raw` mode splunk logger Splunk HEC does not accept log events with an empty string or a whitespace-only string. Signed-off-by: Florian Noeding --- daemon/logger/splunk/splunk.go | 6 ++++++ daemon/logger/splunk/splunk_test.go | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/daemon/logger/splunk/splunk.go b/daemon/logger/splunk/splunk.go index 7319a3e3d5..bdad706eda 100644 --- a/daemon/logger/splunk/splunk.go +++ b/daemon/logger/splunk/splunk.go @@ -15,6 +15,7 @@ import ( "net/url" "os" "strconv" + "strings" "sync" "time" @@ -363,6 +364,11 @@ func (l *splunkLoggerJSON) Log(msg *logger.Message) error { } func (l *splunkLoggerRaw) Log(msg *logger.Message) error { + // empty or whitespace-only messages are not accepted by HEC + if strings.TrimSpace(string(msg.Line)) == "" { + return nil + } + message := l.createSplunkMessage(msg) message.Event = string(append(l.prefix, msg.Line...)) diff --git a/daemon/logger/splunk/splunk_test.go b/daemon/logger/splunk/splunk_test.go index cbe9a55bf9..9c0293a422 100644 --- a/daemon/logger/splunk/splunk_test.go +++ b/daemon/logger/splunk/splunk_test.go @@ -716,12 +716,19 @@ func TestRawFormatWithoutTag(t *testing.T) { if err := loggerDriver.Log(&logger.Message{Line: []byte("notjson"), Source: "stdout", Timestamp: message2Time}); err != nil { t.Fatal(err) } + message3Time := time.Now() + if err := loggerDriver.Log(&logger.Message{Line: []byte(" "), Source: "stdout", Timestamp: message3Time}); err != nil { + t.Fatal(err) + } err = loggerDriver.Close() if err != nil { t.Fatal(err) } + // message3 would have an empty or whitespace only string in the "event" field + // both of which are not acceptable to HEC + // thus here we must expect 2 messages, not 3 if len(hec.messages) != 2 { t.Fatal("Expected two messages") }