parse_key_value sends at the beginning of the result "(0x0800)":true or "(0x0000)":true, why ?

[StefanSa]

hi there,
parse_key_value sends at the beginning of the result "(0x0800)":true or "(0x0000)":true, why ?
{"(0x0800)":true,or {"(0x0800)":true,

Question, why is this information sent along ?

[spencergilbert]

Hi there! parse_key_value has accept_standalone_key set to true by default. You can adjust this option to customize how your event is parsed, based on your needs.

Ref: https://pkg.go.dev/github.com/kr/logfmt#section-documentation #7907

[StefanSa]

@spencergilbert
thank you for the professional help here, unfortunately this is not the case everywhere.

with option accept_standalone_key: falsevector crash after secondes, but generates the correct value (i.e. without standalone key)

2022-01-04T08:41:16.099883Z  WARN vector::internal_events::remap: Mapping failed with event. error="function call error for \"parse_key_value\" at (33:89): could not parse whole line successfully" internal_log_rate_secs=30
2022-01-04T08:41:16.100022Z  WARN vector::internal_events::remap: Internal log [Mapping failed with event.] is being rate limited.
thread 'vector-worker' panicked at 'event will be set', src/transforms/remap.rs:234:48
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'vector-worker' panicked at 'internal error: entered unreachable code: join error or bad poll', src/topology/builder.rs:581:30
2022-01-04T08:41:16.100475Z ERROR transform{component_kind="transform" component_id=ecs_log_mapping component_type=remap component_name=ecs_log_mapping}: vector::topology: An error occurred that vector couldn't handle.Zuer

[spencergilbert]

I totally missed this response, sorry - that definitely is bad. We shouldn't end up in that state, I'd like to open a bug for this if you can share an event we can reproduce with - we should definitely be more graceful there and not panicking

[StefanSa]

@spencergilbert
Grrrrrr, now i have understood the actual problem.
The device that sends this syslog message is not 100% logfmt compliant. It sends this value / field with ether_type=Unknown (0x0000).
Any chance to fix this with parse_key_value ?

[spencergilbert]

Can you share the complete log message?

[StefanSa]

@spencergilbert
Thanks again for your help and time.
Could make a logfmt compliant setting on the devices, so that this problem is solved.