-
Notifications
You must be signed in to change notification settings - Fork 100
Closed
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
Hello, thank you all for creating and maintaining this great tool.
I have determined that trailing whitespace/newlines break automatic json parsing (loki write api):
~ curl -H "Content-Type: application/json" -i -H 'X-Scope-OrgId: redacted' -X POST "https://redacted" -d '{"streams": [{ "stream": { "foo": "bar2" }, "values": [ [ "'$(date -u +%s)'000000000", "{\"foo\": \"bar\", \"_msg\": \"I am broken\"}\n" ] ] }]}'
~ curl -H 'AccountID: redacted ' -H 'ProjectID: 1' http://redacted/select/logsql/query -d 'query=_time:10m "I am broken"'
{"_time":"2026-01-31T01:33:09Z","_stream_id":"001da13b000000017eee9cdfa256d2738ad4624df14db4bb","_stream":"{foo=\"bar2\"}","_msg":"{\"foo\": \"bar\", \"_msg\": \"I am broken\"}\n","foo":"bar2"}
vs
~ curl -H "Content-Type: application/json" -i -H 'X-Scope-OrgId: redacted' -X POST "https://redacted" -d '{"streams": [{ "stream": { "foo": "bar2" }, "values": [ [ "'$(date -u +%s)'000000000", "{\"foo\": \"bar\", \"_msg\": \"I am parsed\"}" ] ] }]}'
~ curl -H 'AccountID: redacted ' -H 'ProjectID: 1' http://redacted/select/logsql/query -d 'query=_time:10m "I am parsed"'
{"_time":"2026-01-31T01:33:01Z","_stream_id":"001da13b000000017eee9cdfa256d2738ad4624df14db4bb","_stream":"{foo=\"bar2\"}","_msg":"I am parsed","foo":"bar"}
I think it would be valuable to trim the input before invoking validation. For now we have added final newline trimming stages to all of our logging agents.
To Reproduce
See curl commands above; ensure the json body in the msg payload ends with a space or \n
Version
v1.44.0
Logs
No errors or messages are logged as a failed json parse is treated as a "normal" unstructured log ingest
Screenshots
No response
Used command-line flags
No response
Additional information
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working