SonarQube server json log format - inconsistent time, missing zeros make it hard to parse

squalou · August 17, 2023, 10:31am

Must-share information (formatted with Markdown):

which versions are you using SonarQube 10.1.0-community
how is SonarQube deployed: Docker
what are you trying to achieve: parse server logs with fluentbit
what have you tried so far to achieve this : see below

Hi,

I have one issue when parsing json logs of SonarQube using fluentbit. A small issue to be honest.

Things mostly work but the time format does not include trailing zeros when there are only zeros.

Example

{"process":"web","timestamp":"2023-08-17T09:50:57.999Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.platform.web.WebServiceReroutingFilter@7ad8fb8f [pattern=UrlPattern{inclusions=[/api/components/update_key, ...], exclusions=[]}]"}
{"process":"web","timestamp":"2023-08-17T09:50:58Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter@2ae6cce1 [pattern=UrlPattern{inclusions=[/*], exclusions=[*.css, ...]}]"}
{"process":"web","timestamp":"2023-08-17T09:50:58Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.authentication.InitFilter@5fc4896c [pattern=UrlPattern{inclusions=[/sessions/init/*], exclusions=[]}]"}
{"process":"web","timestamp":"2023-08-17T09:50:58.001Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.authentication.SamlValidationRedirectionFilter@4

you can see

"timestamp":"2023-08-17T09:50:57.999Z"
"timestamp":"2023-08-17T09:50:58Z"
"timestamp":"2023-08-17T09:50:58.001Z"

So what, should you ask ?

Issue is, when trying to parse the time, I have to set a time format using strptime strptime(3) - Linux man page

see also Configuring Parser - Fluent Bit: Official Manual

so I set : %Y-%m-%dT%H:%M:%S.%L%z

but … it will fail to parse 2023-08-17T09:50:58Z

Would be very nice to have .000 added in this situation.

Kind regards,

alain.kermis · August 18, 2023, 1:34pm

Hi there @squalou,

Welcome to the community

From what we can gather, fluentbit utilizes the strftime(3) library, but as we saw in the official docs, fluentbit added functionality for supporting fractional seconds resolution (the %L format option):

In addition, we extended our time resolution to support fractional seconds like 2017-05-17T15:44:31*.187512963**Z*. Since Fluent Bit v0.12 we have full support for nanoseconds resolution, the %L format option for Time_Format is provided as a way to indicate that content must be interpreted as fractional seconds.

In addition, we observed that the strptime documentation allows for leading zeroes.

In case a number is to be matched, leading zeros are permitted but not required.

It seems that the addition of the %L parameter did not take into account the absence of leading zeroes, which is causing the issue.

Have you tried to reach out to fluentbit with this problem?

Kind Regards
Alain

squalou · August 18, 2023, 6:18pm

Hi,

thank you for this analysis !

I’ll reach them asap with these info (I already have some other issues opened there ),
and update here accordingly.

Also there may be an issue with the absence of dot. I’ll ask too.
(I mean : %S.%L without 0 the dot is also absent which in my case fails to match, but maybe I’m setting the pattern wrong)

Kind regards

squalou · August 24, 2023, 3:20pm

You can check here

github.com/fluent/fluent-bit

Parsing date fails when fractional seconds are all zeros

opened 09:44AM - 22 Aug 23 UTC

squalou

status: waiting-for-triage

## Bug Report **Describe the bug** Parsing date format using a pattern doe…s not allow to parse dates when fractions of seconds are zero, and as a result omitted. (which seems to be allowed by strptime doc) An example will be much more explicit, consider real-life logs below (from sonarQube to name it): ```json { ...., "timestamp":"2023-08-17T09:50:57.999Z", ...} { ...., "timestamp":"2023-08-17T09:50:58Z", ...} { ...., "timestamp":"2023-08-17T09:50:58.001Z", ...} ``` From fluentbit documentation I tried to use `%Y-%m-%dT%H:%M:%S.%L%z` Which will fail with `2023-08-17T09:50:58Z` I have no way to change source logs behaviour. Here's a link to a question asked in sonarQube forum, (in answer they 're asking to ask fluentbit'sadvice ;) ) https://community.sonarsource.com/t/sonarqube-server-json-log-format-inconsistent-time-missing-zeros-make-it-hard-to-parse/97610 According to them, from strptime documentation `leading zeros are permitted but not required.` , which explains that `.000` are omitted, but ... I still have an issue with the `.` separator that is missing. Is there any way to set the pattern with facultative fields ? **To Reproduce** - Example log message if applicable: ``` {"process":"web","timestamp":"2023-08-17T09:50:57.999Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.platform.web.WebServiceReroutingFilter@7ad8fb8f [pattern=UrlPattern{inclusions=[/api/components/update_key, ...], exclusions=[]}]"} {"process":"web","timestamp":"2023-08-17T09:50:58Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter@2ae6cce1 [pattern=UrlPattern{inclusions=[/*], exclusions=[*.css, ...]}]"} {"process":"web","timestamp":"2023-08-17T09:50:58.001Z","severity":"INFO","logger":"org.sonar.server.platform.web.MasterServletFilter","message":"Initializing servlet filter org.sonar.server.authentication.InitFilter@5fc4896c [pattern=UrlPattern{inclusions=[/sessions/init/*], exclusions=[]}]"} ``` Will result with following error ``` [2023/08/22 09:41:47] [error] [parser] cannot parse '2023-08-17T09:50:58Z' ``` - Steps to reproduce the problem: Use following configuration parser ``` [PARSER] Name sonar Format json Time_Key timestamp Time_Format %Y-%m-%dT%H:%M:%S.%L%z ``` conf ``` [SERVICE] flush 1 log_level debug parsers_file /fluent-bit/etc/fluent-bit-parsers.conf [INPUT] name tail path /test.log read_from_head true [FILTER] Name parser Match * Key_Name log Parser sonar [OUTPUT] Name stdout Match * ``` **Expected behavior** 3 logs in above example are correctly parsed **Your Environment** * Version used: 2.31.11 * Configuration: local docker (linux) * Environment name and version : target environment : AWS ECS * Server type and version: laptop :) * Operating System and version: linux 6.4.6 * Filters and plugins: **Additional context**

So far, a Ruby implem and a Golang implem fail to parse too when .000 is missing.
(using the Time.strptime for ruby)

Again, even if the “zeros” are optionnal, there is anyway still the issue of the separator (with is dot but could be comma). Missing separator will always fail to be parsed IMHO.

alain.kermis · September 1, 2023, 2:31pm

Hi there again @squalou,

Many thanks for taking this further with your bug tickets.

Upon further investigation on our side, we do feel that this is also a bug, hence this ticket being created.

Many thanks to you for bringing this up with us, and we hope to see you in the community again!

Regards

squalou · September 1, 2023, 2:54pm

thank you !

system · September 8, 2023, 3:24pm

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.