splunk / splunk/splunk-library-javalogging
Splunk client swallows server error response in non-JSON format
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 140
- Forks
- 173
- PR merge metrics
- No merged PRs in 30d
Description
When sending logs to HEC endpoint and not receiving 200x response code with response body in non-JSON, Splunk swallows actual response body and throws MalformedJsonException.
Eg.:
Response body:
</html>
</body>
<hr><center>nginx/1.21.3</center>
<center><h1>502 Bad Gateway</h1></center>
<body>
<head><title>502 Bad Gateway</title></head>
<html>
Splunk logs:
Message: ServerErrorException: com.google.gson.stream.MalformedJsonException: Use JsonReader.setLenient(true) to accept malformed JSON at line 2 column 2 path $
Because try-catch block swallows the response body in com.splunk.logging.HttpEventCollectorErrorHandler.ServerErrorException#ServerErrorException:
try {
// read server reply
JsonObject json = JsonParser.parseString(serverReply).getAsJsonObject();
errorCode = json.get("code").getAsLong();
errorText = json.get("text").getAsString();
} catch (Exception e) {
errorText = e.getMessage();
}
and in com.splunk.logging.util.StandardErrorCallback used method ex.getMessage() which returns errorText.
So, in order to preserve proper response body in logs we need to write custom ErrorCallback but would be great to do it via standard methods as other response body format can be returned.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with com.splunk.logging.HttpEventCollectorErrorHandler.ServerErrorException#ServerErrorException and com.splunk.logging.util.StandardErrorCallback. Trace how a non-JSON server reply becomes errorText and then reaches the logs. Done means the original response body is preserved for non-JSON errors while existing structured Splunk error responses continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- observability
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 42/100