False-positive static analysis warning when using structured logging

Clean Code Report False-positive / False-negative...
1

  • What language is this for?
    Java

  • Which rule?
    java:S3457

  • Why do you believe it’s a false-positive/false-negative?
    With logback-logstash-encoder library one can write the code as the following:
    log.info("Message", kv("k1", "v1"), kv("k2", "v2"));

SONAR will detect this like a problem, but it is not, structured arguments is not participating in message formatting, but logged as separate structure to be later indexed by external systems like Splunk.

  • Are you using

    • SonarLint - which IDE/version?
      SonarLint for IntelliJ IDEA: 10.10.0.79575

  • How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

Steps to reproduce:

  1. Create empty project.
  2. Add slf4j, logback and logstash-logback-encoder.
  3. Create simple class like:
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import static net.logstash.logback.argument.StructuredArguments.kv;

public class Demo {
    public static final Logger log = LoggerFactory.getLogger(Demo.class);

    public void demo() {
        log.info("Message",
                kv("k1", "v1"),
                kv("k2", "v2")
        );
    }

    public static void main(String... args) {
        Demo d = new Demo();

        d.demo();
    }
}

SONAR warning: String contains no format specifiers.

Same issue was reported by me for IntelliJ IDEA: https://youtrack.jetbrains.com/issue/IDEA-354390
It was fixed by this commit: [uast-inspections] IDEA-354390 Support structured logging for SLF4J · JetBrains/intellij-community@71cab9b · GitHub

Probably it can help to implement similar fix for SONAR.

Thank you.

2 Likes
4

Hello, @kuaw26, welcome to the Sonar Community, and thank you for raising this false positive.

You can track the progress on the resolution at [SONARJAVA-5133] - Jira.

Cheers,
Angelo