RUMM-513 Validating JSON payload before sending to intake #194
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What and why?
We observe non-parseable logs sent to intake
In a certain org which has high volumes of logs,
%0.3-0.5 of all logs are not parsed properly in dashboard
Hypothesis #1
Data being read is malformed, because every malformed log has their malformed part at the very end
So if we can read the file later, we can have valid payload
Hypothesis #2
Write op corrupts the file and we need to watch write ops closely so that we can catch and recover errors
This requires major refactoring in File.swift and related files
How?
This commit implements the first hypothesis by validating the payload before uploading it to intake
How to test the fix?
There are other cases than null bytes at the end, such as incomplete log message, this fix should also cover them
Review checklist