allow for json/ndjson content type with charset (#32767)

* allow for json/ndjson content type with charset * add '; charset=UTF-8' in integration tests * changelog * assessing CI * revert correct behaviour
elastic · Jun 1, 2023 · 39f4e64 · 39f4e64
1 parent 7215f9b
commit 39f4e64
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 8 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -60,6 +60,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Fix handling of Checkpoint event for R81. {issue}32380[32380] {pull}32458[32458]
 - Fix a hang on `apt-get update` stage in packaging. {pull}32580[32580]
 - gcp-pubsub input: Restart Pub/Sub client on all errors. {issue}32550[32550] {pull}32712[32712]
+- Fix not parsing as json when `json` and `ndjson` content types have charset information in `aws-s3` input {pull}32767[32767]
 - Update `cloud.region` parsing in cloudtrail fileset. {pull}32763[32763]
 - Fix file.path field in cloudtrail fileset to use json.digestS3Object. {pull}32759[32759]
 - Fix rendering of MAC addresses to conform to ECS. {issue}32621[32621] {pull}32622[32622]

diff --git a/x-pack/filebeat/input/awss3/input_integration_test.go b/x-pack/filebeat/input/awss3/input_integration_test.go
@@ -18,6 +18,7 @@ import (
 	"path"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 	"time"
 
@@ -88,7 +89,6 @@ file_selectors:
 -
   regex: 'events-array.json$'
   expand_event_list_from_field: Events
-  content_type: application/json
   include_s3_metadata:
     - last-modified
     - x-amz-version-id
@@ -97,7 +97,6 @@ file_selectors:
     - Content-Type
 -
   regex: '\.(?:nd)?json(\.gz)?$'
-  content_type: application/json
 -
   regex: 'multiline.txt$'
   parsers:
@@ -117,7 +116,6 @@ file_selectors:
 -
   regex: 'events-array.json$'
   expand_event_list_from_field: Events
-  content_type: application/json
   include_s3_metadata:
     - last-modified
     - x-amz-version-id
@@ -126,7 +124,6 @@ file_selectors:
     - Content-Type
 -
   regex: '\.(?:nd)?json(\.gz)?$'
-  content_type: application/json
 -
   regex: 'multiline.txt$'
   parsers:
@@ -328,11 +325,19 @@ func uploadS3TestFiles(t *testing.T, region, bucket string, filenames ...string)
 			t.Fatalf("Failed to open file %q, %v", filename, err)
 		}
 
+		contentType := ""
+		if strings.HasSuffix(filename, "ndjson") || strings.HasSuffix(filename, "ndjson.gz") {
+			contentType = contentTypeNDJSON + "; charset=UTF-8"
+		} else if strings.HasSuffix(filename, "json") || strings.HasSuffix(filename, "json.gz") {
+			contentType = contentTypeJSON + "; charset=UTF-8"
+		}
+
 		// Upload the file to S3.
 		result, err := uploader.Upload(context.Background(), &s3.PutObjectInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(filepath.Base(filename)),
-			Body:   bytes.NewReader(data),
+			Bucket:      aws.String(bucket),
+			Key:         aws.String(filepath.Base(filename)),
+			Body:        bytes.NewReader(data),
+			ContentType: aws.String(contentType),
 		})
 		if err != nil {
 			t.Fatalf("Failed to upload file %q: %v", filename, err)

diff --git a/x-pack/filebeat/input/awss3/s3_objects.go b/x-pack/filebeat/input/awss3/s3_objects.go
@@ -153,7 +153,7 @@ func (p *s3ObjectProcessor) ProcessS3Object() error {
 
 	// Process object content stream.
 	switch {
-	case contentType == contentTypeJSON || contentType == contentTypeNDJSON:
+	case strings.HasPrefix(contentType, contentTypeJSON) || strings.HasPrefix(contentType, contentTypeNDJSON):
 		err = p.readJSON(reader)
 	default:
 		err = p.readFile(reader)