report_json not sufficiently escaping quotes
Bjørn Ruberg
bjorn at ruberg.no
Tue Jun 27 09:15:17 CEST 2017
The "report_json" log template format seems to lack one backslash when
escaping quotes. My JSON recipient (Logstash) is not able to parse
Amavis' output in its current form.
This excerpt is not considered valid by Logstash nor jq(1):
{
"@timestamp": "2017-06-27T06:58:42.390Z",
"action": [
"PASS"
],
"actions_performed": "RelayedInbound",
[...]
"subject": "Welcome to the \\"clamav-virusdb\\" mailing list",
"subject_rot13": "Jrypbzr gb gur \\"pynzni-ivehfqo\\" znvyvat yvfg",
[...]
"type": "amavis"
}
Adding an extra backslash, the JSON is valid:
{
"@timestamp": "2017-06-27T06:58:42.390Z",
"action": [
"PASS"
],
"actions_performed": "RelayedInbound",
[...]
"subject": "Welcome to the \\\"clamav-virusdb\\\" mailing list",
"subject_rot13": "Jrypbzr gb gur \\\"pynzni-ivehfqo\\\" znvyvat yvfg",
[...]
"type": "amavis"
}
--
Bjørn
More information about the amavis-users
mailing list