Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Splunk client swallows server error response in non-JSON format #267

Open
artem-emelin opened this issue Dec 9, 2022 · 0 comments
Open

Splunk client swallows server error response in non-JSON format #267

artem-emelin opened this issue Dec 9, 2022 · 0 comments

Comments

@artem-emelin
Copy link

When sending logs to HEC endpoint and not receiving 200x response code with response body in non-JSON, Splunk swallows actual response body and throws MalformedJsonException.

Eg.:
Response body:

</html>
</body>
<hr><center>nginx/1.21.3</center>
<center><h1>502 Bad Gateway</h1></center>
<body>
<head><title>502 Bad Gateway</title></head>
<html>

Splunk logs:

Message: ServerErrorException: com.google.gson.stream.MalformedJsonException: Use JsonReader.setLenient(true) to accept malformed JSON at line 2 column 2 path $

Because try-catch block swallows the response body in com.splunk.logging.HttpEventCollectorErrorHandler.ServerErrorException#ServerErrorException:

            try {
                // read server reply
                JsonObject json = JsonParser.parseString(serverReply).getAsJsonObject();
                errorCode = json.get("code").getAsLong();
                errorText = json.get("text").getAsString();
            } catch (Exception e) {
                errorText = e.getMessage();
            }

and in com.splunk.logging.util.StandardErrorCallback used method ex.getMessage() which returns errorText.

So, in order to preserve proper response body in logs we need to write custom ErrorCallback but would be great to do it via standard methods as other response body format can be returned.
@artem-emelin artem-emelin changed the title Splunk client swallows server response in non-JSON format Splunk client swallows server error response in non-JSON format Dec 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@artem-emelin