Graylog2 / Graylog2/graylog2-server

Collector ingets input can receive non-unique `KeyValueList` keys from Windows event receiver payloads

Open
#25,715 0 comments 0 reactions 0 assignees View on GitHub
collector
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Found a case in our repo where OTLP log body data contains a `kvlist_value` with non-unique keys:

`graylog2-server/src/test/resources/org/graylog/collectors/input/processor/windows-2025-eventlog-1.ndjson`

In the PowerShell events there, `event_data` contains multiple entries with `key: ""` (for example around `record_id=8526`). This shape is likely produced by the Windows event receiver for unnamed `EventData` elements.

That is problematic because OTLP `KeyValueList` is supposed to have unique keys. The proto/docs say:

- `KeyValueList`: “The keys MUST be unique”
- “The behavior of software that receives duplicated keys can be unpredictable”

Source:
`https://pkg.go.dev/go.opentelemetry.io/proto/otlp/common/v1`

This means any code that materializes such payloads into normal maps / JSON objects can silently lose data.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.