[
https://issues.apache.org/jira/browse/LOG4J2-2337?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16807706#comment-16807706
]
Patrice Ferrot commented on LOG4J2-2337:
----------------------------------------
Hi - I experienced a similar issue that basically made it impossible to
properly index logs produced with the JsonLayout in Splunk. In my case, it
turns out it was actually journalctl producing arrays of bytes when exporting
JSON when log entries contain the '\r' character. So log4j2 JsonLayout -->
journalctl export as JSON --> Splunk would essentially not work properly.
Anyway, I worked on an enhancement that allows to customise the end-of-line
string. Setting it to "\n" fixes the problem in my case (as it should for those
who face a similar issue). No more '\r', so no more arrays of bytes, so me
happy checking logs in Splunk :)
I hope you can integrate the PRs I created (one for master and one for the 2.x
branch):
[https://github.com/apache/logging-log4j2/pull/264]
[https://github.com/apache/logging-log4j2/pull/265]
> JSONLayout printing \r at end of line
> -------------------------------------
>
> Key: LOG4J2-2337
> URL: https://issues.apache.org/jira/browse/LOG4J2-2337
> Project: Log4j 2
> Issue Type: Bug
> Environment: Server run on Unix environment.
> Reporter: Arvind Sahare
> Priority: Major
> Attachments: Screen Shot 2018-05-11 at 12.06.51.png
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Log4j JSONLayout with eventEol="true", prints '\r' at end of log.
> Example:- \{"key":"value", "key":"value"}\r
>
> Problem - Currently we are using Splunk for log analysis, which is not able
> to render Log string as JSON, due to \r getting printed. Can we avoid it
> getting printed?
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
