SyntaxError: JSON Parse error: Unrecognized token '' statusCode: 400

[fruworg]

Hello. I am trying to send logs using vector to qryn, but I am encountering an error (SyntaxError: JSON Parse error: Unrecognized token '' statusCode: 400).

qryn version - 3.3.2
vector version - 0.45.0

vector.toml

[sources.metrics]
type = "host_metrics"
scrape_interval_secs = 10

[sinks.qryn_metrics]
type = "prometheus_remote_write"
inputs = ["metrics"]
endpoint = "http://monitoring.replaced.com:3100/api/v1/write"

[sources.1c-ka]
type = "file"
include = ["/tmp/lol_*.log"]

[sources.1c-ka.multiline]
start_pattern = "^[^\\s]"
mode = "continue_past"
condition_pattern = "^[^']"
timeout_ms = 1000

[transforms.1c-ka-fmt]
type = "remap"
inputs = ["1c-ka"]
source = '''
. = parse_regex!(.message, r'(?P<timestamp>\d{2}:\d{2}\.\d+)-\d+,(?P<logType>[A-Z]+),\d+,level=(?P<level>[A-Z]+),process=(?P<process>\w+),p:processName=(?P<processName>[^,]+),t:clientID=(?P<clientID>\d+),t:applicationName=(?P<applicationName>[^,]+),t:computerName=(?P<computerName>[^,]+),t:connectID=(?P<connectID>\d+),SessionID=(?P<sessionID>\d+),Usr=(?P<user>\w+),Exception=(?P<exceptionID>[a-f0-9-]+),Descr=\'?(?P<description>[^\']+)')
'''

[sinks.print]
type = "console"
inputs = ["1c-ka-fmt"]

[sinks.loki]
type = "loki"
inputs = ["1c-ka-fmt"]
endpoint = "http://monitoring.replaced.com:3100"
compression = "gzip"
healthcheck = true
labels = { job = "1c-ka", host = "workstation" }

[sinks.loki.encoding]
codec = "json"

[sinks.print.encoding]
codec = "json"

lol_1.log

08:53.489003-0,EXCP,2,level=WARNING,process=rphost,p:processName=PROD_KA,t:clientID=1234,t:applicationName=BackgroundJob,t:computerName=1c-test,t:connectID=4321,SessionID=1111,Usr=DefUser,Exception=8d364444-4d66-4d66-4d66-deadbeaf3333,Descr='src/rserver/src/ServerJobExecutor.cpp(1257):
8d364444-4d66-4d66-4d66-deadbeaf3333: text 2342 text.
text text text,
text "text" text ТЕКСТ
{Текст.Текст.Текст(1234)}:         текст;
'

vector logs

root@workstation:/tmp# rm -rf /var/lib/vector/* && vector --config /etc/vector/vector.toml
2025-02-27T10:54:10.840867Z  INFO vector::app: Log level is enabled. level="info"
2025-02-27T10:54:10.841432Z  INFO vector::app: Loading configs. paths=["/etc/vector/vector.toml"]
2025-02-27T10:54:10.848656Z  INFO source{component_kind="source" component_id=metrics component_type=host_metrics}: vector::sources::host_metrics: PROCFS_ROOT is unset. Using default '/proc' for procfs root.
2025-02-27T10:54:10.848875Z  INFO source{component_kind="source" component_id=metrics component_type=host_metrics}: vector::sources::host_metrics: SYSFS_ROOT is unset. Using default '/sys' for sysfs root.
2025-02-27T10:54:10.904286Z  INFO vector::topology::running: Running healthchecks.
2025-02-27T10:54:10.904960Z  INFO vector: Vector has started. debug="false" version="0.45.0" arch="x86_64" revision="063cabb 2025-02-24 14:52:02.810034614"
2025-02-27T10:54:10.905107Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
2025-02-27T10:54:10.905279Z  INFO vector::topology::builder: Healthcheck passed.
2025-02-27T10:54:10.906228Z  INFO source{component_kind="source" component_id=1c-ka component_type=file}: vector::sources::file: Starting file server. include=["/tmp/lol_*.log"] exclude=[]
2025-02-27T10:54:10.907400Z  INFO source{component_kind="source" component_id=1c-ka component_type=file}:file_server: file_source::checkpointer: Attempting to read legacy checkpoint files.
2025-02-27T10:54:10.911684Z  INFO vector::topology::builder: Healthcheck passed.
2025-02-27T10:54:10.915626Z  INFO source{component_kind="source" component_id=1c-ka component_type=file}:file_server: vector::internal_events::file::source: Found new file to watch. file=/tmp/lol_1.log
2025-02-27T10:54:10.916560Z  INFO vector::topology::builder: Healthcheck passed.
{"applicationName":"BackgroundJob","clientID":"1234","computerName":"1c-test","connectID":"4321","description":"src/rserver/src/ServerJobExecutor.cpp(1257):\n8d364444-4d66-4d66-4d66-deadbeaf3333: text 2342 text.\ntext text text,\ntext \"text\" text ТЕКСТ\n{Текст.Текст.Текст(1234)}:         текст;\n","exceptionID":"8d364444-4d66-4d66-4d66-deadbeaf3333","level":"WARNING","logType":"EXCP","process":"rphost","processName":"PROD_KA","sessionID":"1111","timestamp":"08:53.489003","user":"DefUser"}
2025-02-27T10:54:11.925564Z  WARN sink{component_kind="sink" component_id=loki component_type=loki}:request{request_id=1}: vector::sinks::util::retries: Retrying after error. error=Server responded with an error: 500 Internal Server Error internal_log_rate_limit=true
2025-02-27T10:54:12.924794Z  WARN sink{component_kind="sink" component_id=loki component_type=loki}:request{request_id=1}: vector::sinks::util::retries: Internal log [Retrying after error.] is being suppressed to avoid flooding.

json is valid

root@workstation:/tmp# cat lol.json | jq
{
  "applicationName": "BackgroundJob",
  "clientID": "1234",
  "computerName": "1c-test",
  "connectID": "4321",
  "description": "src/rserver/src/ServerJobExecutor.cpp(1257):\n8d364444-4d66-4d66-4d66-deadbeaf3333: text 2342 text.\ntext text text,\ntext \"text\" text ТЕКСТ\n{Текст.Текст.Текст(1234)}:         текст;\n",
  "exceptionID": "8d364444-4d66-4d66-4d66-deadbeaf3333",
  "level": "WARNING",
  "logType": "EXCP",
  "process": "rphost",
  "processName": "PROD_KA",
  "sessionID": "1111",
  "timestamp": "08:53.489003",
  "user": "DefUser"
}

qryn logs

qryn-1             | {"level":30,"time":1740653650906,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/api/v1/write"}
qryn-1             | {"level":30,"time":1740653650907,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/ready"}
qryn-1             | {"level":30,"time":1740653650964,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/api/v1/write"}
qryn-1             | {"level":30,"time":1740653651917,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/loki/api/v1/push"}
qryn-1             | 37 |     if (length > 5 * 1024 * 1024) {
qryn-1             | 38 |       return
qryn-1             | 39 |     }
qryn-1             | 40 |     await shaper.register(length)
qryn-1             | 41 |     const body = await getContentBody(req, payload)
qryn-1             | 42 |     return JSON.parse(body)
qryn-1             |                      ^
qryn-1             | SyntaxError: JSON Parse error: Unrecognized token ''
qryn-1             |  statusCode: 400,
qryn-1             |
qryn-1             |       at <anonymous> (/app/parsers.js:42:17)
qryn-1             | POST - http://monitoring.replaced.com:3100/loki/api/v1/push failed
qryn-1             | {"level":30,"time":1740653651966,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/api/v1/write"}
qryn-1             | {"level":30,"time":1740653652916,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/loki/api/v1/push"}
qryn-1             | 37 |     if (length > 5 * 1024 * 1024) {
qryn-1             | 38 |       return
qryn-1             | 39 |     }
qryn-1             | 40 |     await shaper.register(length)
qryn-1             | 41 |     const body = await getContentBody(req, payload)
qryn-1             | 42 |     return JSON.parse(body)
qryn-1             |                      ^
qryn-1             | SyntaxError: JSON Parse error: Unrecognized token ''
qryn-1             |  statusCode: 400,
qryn-1             |
qryn-1             |       at <anonymous> (/app/parsers.js:42:17)
qryn-1             | POST - http://monitoring.replaced.com:3100/loki/api/v1/push failed
qryn-1             | {"level":30,"time":1740653653692,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/loki/api/v1/push"}
qryn-1             | 37 |     if (length > 5 * 1024 * 1024) {
qryn-1             | 38 |       return
qryn-1             | 39 |     }
qryn-1             | 40 |     await shaper.register(length)
qryn-1             | 41 |     const body = await getContentBody(req, payload)
qryn-1             | 42 |     return JSON.parse(body)
qryn-1             |                      ^
qryn-1             | SyntaxError: JSON Parse error: Unrecognized token ''
qryn-1             |  statusCode: 400,
qryn-1             |
qryn-1             |       at <anonymous> (/app/parsers.js:42:17)
qryn-1             | POST - http://monitoring.replaced.com:3100/loki/api/v1/push failed
qryn-1             | {"level":30,"time":1740653654680,"pid":1,"hostname":"399e2db4d75e","name":"qryn","msg":"http://monitoring.replaced.com:3100/loki/api/v1/push"}
qryn-1             | 37 |     if (length > 5 * 1024 * 1024) {
qryn-1             | 38 |       return
qryn-1             | 39 |     }
qryn-1             | 40 |     await shaper.register(length)
qryn-1             | 41 |     const body = await getContentBody(req, payload)
qryn-1             | 42 |     return JSON.parse(body)
qryn-1             |                      ^
qryn-1             | SyntaxError: JSON Parse error: Unrecognized token ''
qryn-1             |  statusCode: 400,
qryn-1             |
qryn-1             |       at <anonymous> (/app/parsers.js:42:17)
qryn-1             | POST - http://monitoring.replaced.com:3100/loki/api/v1/push failed