Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

bug: splunk-hec-logging crashes with nil concatenation when error response json lacks text field

Open Beginner friendly
  • Is something wrong?
#14,011 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 5 days

@bhuvan-somisetty is already working on this.

Since Oct 7, 2026.

  • #14012 by @bhuvan-somisetty — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
lua
Domain
backend

Research direction

Read apisix/plugins/splunk-hec-logging.lua, especially send_to_splunk and the non-200 response handling around line 177. Check the plugin's existing tests and run the relevant test for Splunk HEC logging. Done means non-200 JSON responses without text return a useful error instead of crashing; the issue also flags handling failed JSON encoding in the batch-building loop.

Written by the indexing model from the issue text.

Description

bug
Current Behavior

In apisix/plugins/splunk-hec-logging.lua, the send_to_splunk function handles non-200 responses from the Splunk HEC endpoint as follows:

    if res.status ~= 200 then
        local body = core.json.decode(res.body)
        if not body then
            return false, "failed to send splunk, http status code: " .. res.status
        else
            return false, "failed to send splunk, " .. body.text
        end
    end

When Splunk HEC (or any intermediate proxy / API gateway / reverse proxy in front of Splunk, such as an AWS ALB, Kong, Cloudflare, or NGINX ingress) returns an HTTP error status code (such as 400, 401, 403, 500, or 502) with a valid JSON payload that does not contain a text property (e.g. {"message": "Unauthorized"}, {"error": "Forbidden"}, {"code": 403}, or {}), core.json.decode(res.body) decodes into a Lua table (body ~= nil).

In the else block, body.text evaluates to nil, leading to string concatenation .. body.text. This throws an unhandled Lua runtime error:
attempt to concatenate field 'text' (a nil value).

This causes the batch processor background timer/worker to crash instead of cleanly returning false, err to handle retries and error logging.

Additionally, in send_to_splunk:

    local t = {}
    for _, e in ipairs(entries) do
        table_insert(t, core.json.encode(e))
    end

If core.json.encode(e) fails for any entry, it returns nil, err and inserts nil into t, resulting in corrupted batch payloads or issues on table_concat(t).

Expected Behavior

send_to_splunk should safely handle non-200 JSON responses where body.text is not present, falling back to other common error fields (like body.message or res.body or status code), rather than crashing with attempt to concatenate field 'text' (a nil value).

Error Logs
2026/10/07 08:30:00 [error] 51234#51234: *123456 [lua] batch-processor.lua:105: ...x/plugins/splunk-hec-logging.lua:177: attempt to concatenate field 'text' (a nil value), context: ngx.timer
stack traceback:
    ...x/plugins/splunk-hec-logging.lua:177: in function 'send_to_splunk'
    .../apisix/utils/batch-processor.lua:100: in function 'batch_processor'
Steps to Reproduce
  1. Configure a route with the splunk-hec-logging plugin pointing to an endpoint that returns an error status code with JSON missing text, for example HTTP 401 {"message": "Unauthorized"} or HTTP 403 {"error": "Forbidden"}.
  2. Send requests through the route to generate log entries.
  3. When the batch processor flushes the batch to Splunk, observe the error log: attempt to concatenate field 'text' (a nil value).
Environment
  • APISIX version (run apisix version): master (3.19.0)
  • Operating system (run uname -a): Linux 5.15.0-generic x86_64
  • OpenResty / Nginx version (run openresty -V or nginx -V): openresty/1.25.3.1
  • etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info): 3.5.11
Dominant language
Lua
Stars
17.2k
Forks
3k
Avg merge
5d 48m
Merged PRs (30d)
19

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/apisix

All issues in apache/apisix

Similar issues

More Lua issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.