HEC tweaks

Damien Dallimore · Damien Dallimore · commit 3092752c3a70 · 2015-11-10T10:09:19.000+07:00
diff --git a/src/com/splunk/logging/SplunkHECInput.java b/src/com/splunk/logging/SplunkHECInput.java
@@ -181,6 +181,29 @@ private String wrapMessageInQuotes(String message) {
 		return "\"" + message + "\"";
 	}
 
+	/**
+	 * from Tivo
+	 * 
+	 * @param message
+	 * @return
+	 */
+	private String escapeMessageIfNeeded(String message) {
+		String trimmedMessage = message.trim();
+		if (trimmedMessage.startsWith("{") && trimmedMessage.endsWith("}")) {
+			// this is *probably* JSON.
+			return trimmedMessage;
+		} else if (trimmedMessage.startsWith("\"")
+				&& trimmedMessage.endsWith("\"")
+				&& !message.substring(1, message.length() - 1).contains("\"")) {
+			// this appears to be a quoted string with no internal quotes
+			return trimmedMessage;
+		} else {
+			// don't know what this thing is, so need to escape all quotes, and
+			// then wrap the result in quotes
+			return "\"" + message.replace("\"", "\\\"") + "\"";
+		}
+	}
+	
 	/**
 	 * send an event via stream
 	 * 
@@ -191,9 +214,7 @@ public void streamEvent(String message) {
 		String currentMessage = "";
 		try {
 
-			if (!(message.startsWith("{") && message.endsWith("}"))
-					&& !(message.startsWith("\"") && message.endsWith("\"")))
-				message = wrapMessageInQuotes(message);
+			message = escapeMessageIfNeeded(message);
 
 			// could use a JSON Object , but the JSON is so trivial , just
 			// building it with a StringBuffer
