report_json not sufficiently escaping quotes

Bjørn Ruberg bjorn at ruberg.no
Tue Jun 27 09:15:17 CEST 2017


The "report_json" log template format seems to lack one backslash when
escaping quotes. My JSON recipient (Logstash) is not able to parse
Amavis' output in its current form.

This excerpt is not considered valid by Logstash nor jq(1):

{
  "@timestamp": "2017-06-27T06:58:42.390Z",
  "action": [
    "PASS"
  ],
  "actions_performed": "RelayedInbound",
  [...]
  "subject": "Welcome to the \\"clamav-virusdb\\" mailing list",
  "subject_rot13": "Jrypbzr gb gur \\"pynzni-ivehfqo\\" znvyvat yvfg",
  [...]
  "type": "amavis"
}

Adding an extra backslash, the JSON is valid:

{
  "@timestamp": "2017-06-27T06:58:42.390Z",
  "action": [
    "PASS"
  ],
  "actions_performed": "RelayedInbound",
  [...]
  "subject": "Welcome to the \\\"clamav-virusdb\\\" mailing list",
  "subject_rot13": "Jrypbzr gb gur \\\"pynzni-ivehfqo\\\" znvyvat yvfg",
  [...]
  "type": "amavis"
}

-- 
Bjørn


More information about the amavis-users mailing list