Description
A codec randomly adds new line (might be whitespace) in the event payload. The behavior happens with streaming input plugins such as TCP or UDP. As I have confirmed, when TCP buffer gets full (64K), the buffer gets flushed and moved to the codec. The buffer treated with new line in a reality is a part of event but codec doesn't have information about it, so continues with text.split("\n").each do |line| which eventually adds new line.
We have an effort in the past to fix it but it ended up with not landing since it was a broad (depending on use-case): #63
Related:
This issue is a placeholder to re-activate the discussion and bring a fix/solution/agreement to fix the issue for the long term.
Current quick thought to fix:
- Reviving the effort to add BufTok to the Multiline codec, with the cumbersome flag to tell the codec that it is running in "streaming mode".
- Bringing BufTok into the input plugins, to ensure that it only ever emits whole lines to the codec (opt-in, with a flag to tell the plugin that its expecting line-oriented input; will need to ensure a buffer flush on close)
Description
A codec randomly adds new line (might be whitespace) in the event payload. The behavior happens with streaming input plugins such as TCP or UDP. As I have confirmed, when TCP buffer gets full (64K), the buffer gets flushed and moved to the codec. The buffer treated with new line in a reality is a part of event but codec doesn't have information about it, so continues with
text.split("\n").each do |line|which eventually adds new line.We have an effort in the past to fix it but it ended up with not landing since it was a broad (depending on use-case): #63
Related:
input_typein "dual modes" codecs elastic/logstash#11885This issue is a placeholder to re-activate the discussion and bring a fix/solution/agreement to fix the issue for the long term.
Current quick thought to fix: