parser_syslog: string parser ends RFC5424 structured data at an escaped "]"

Open Beginner friendly
  • Is something wrong?
#5,587 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@yuminn-k is already working on this.

Since Nov 5, 2026.

  • #5591 by @yuminn-k — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
ruby
Domain
backend

Research direction

Start in parse_rfc5424, where the issue says text.index('] ', cursor) finds the structured data boundary, and compare the string parser with the regexp parser using the supplied RFC5424 input. Trace the parser's existing tests and add a regression case for an escaped ] followed by a space. Done when extradata contains the complete structured data and message is msg.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

With parser_engine string, parser_syslog ends STRUCTURED-DATA at the first ] in the message. It does not check whether the ] is escaped. When a PARAM-VALUE contains \] followed by a space, the rest of the structured data goes into message.

RFC 5424 section 6.3.3 requires ] in a PARAM-VALUE to be escaped as \], so this is a valid message.

Input:

<14>1 2026-04-25T16:43:29.123Z host app 123 ID [x@1 a="b\] c"] msg
extradata message
parser_engine string [x@1 a="b] c"] msg
parser_engine regexp [x@1 a="b\] c"] msg
To Reproduce

  1. Create /tmp/syslog.log with this line:

    <14>1 2026-04-25T16:43:29.123Z host app 123 ID [x@1 a="b\] c"] msg

  2. Run Fluentd with the configuration below.

Expected behavior

extradata contains the whole structured data and message is msg, as with parser_engine regexp.

Actual output:

test: {"host":"host","ident":"app","pid":"123","msgid":"ID","pri":14,"extradata":"[x@1 a=\"b]","message":"c\"] msg"}
Your Environment
- Fluentd version: 1.20.1 (master at f55db4b1)
- Package version: N/A (from source)
- Operating system: CachyOS
- Kernel version: 7.3.1-1-cachyos
- Ruby: 4.0.9
Your Configuration
<source>
  @type tail
  path /tmp/syslog.log
  pos_file /tmp/syslog.log.pos
  read_from_head true
  tag test
  <parse>
    @type syslog
    message_format rfc5424
    with_priority true
    parser_engine string
  </parse>
</source>

<match test>
  @type stdout
</match>
Your Error Log
No error is logged. The record is emitted with wrong fields.
Additional context

parse_rfc5424 finds the end of the structured data with text.index('] ', cursor). This exists since v1.11.0.

Dominant language
Ruby
Stars
13.6k
Forks
1.4k
Avg merge
1d 4h
Merged PRs (30d)
56

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fluent/fluentd

All issues in fluent/fluentd

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.