Plainnotes

One unescaped newline breaks the whole log line

2024-06-22 · 2 min readTools

After moving to structured logs, the collector occasionally reports parse errors and drops a batch. The message field contained a newline or a quote that was never escaped:

{"msg": "failed:
connection reset"}

Not JSON. Serialize the whole object with a library instead of concatenating strings:

json.dumps({"msg": msg, "ts": ts})

With a logging framework, confirm the encoder is JSON rather than a pattern, and that stack traces go in a string field rather than several lines.

Non-UTF-8 bytes are the other common failure; base64 them or filter before serialization.

Collectors can also keep unparsable lines in a _raw field rather than dropping them.