Graylog2 / Graylog2/graylog2-server
Collector ingets input can receive non-unique `KeyValueList` keys from Windows event receiver payloads
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Found a case in our repo where OTLP log body data contains a `kvlist_value` with non-unique keys:
`graylog2-server/src/test/resources/org/graylog/collectors/input/processor/windows-2025-eventlog-1.ndjson`
In the PowerShell events there, `event_data` contains multiple entries with `key: ""` (for example around `record_id=8526`). This shape is likely produced by the Windows event receiver for unnamed `EventData` elements.
That is problematic because OTLP `KeyValueList` is supposed to have unique keys. The proto/docs say:
- `KeyValueList`: “The keys MUST be unique”
- “The behavior of software that receives duplicated keys can be unpredictable”
Source:
`https://pkg.go.dev/go.opentelemetry.io/proto/otlp/common/v1`
This means any code that materializes such payloads into normal maps / JSON objects can silently lose data.
Contributor guide
Assessment
This issue has not been assessed yet.