Incorrect Backslash Escaping in Array Elements in GELF Output

[ishulgan]

Bug Report

Describe the bug
When processing log messages containing strings with backslashes (\) inside arrays using Fluent Bit’s GELF output plugin, the backslashes are incorrectly converted into single backslashes (). This leads to malformed log messages in Graylog, causing errors or unexpected behavior due to the incorrect formatting of the message field.

To Reproduce
Example log message:

2024-11-22T16:28:55.518280367+03:00 stdout F {"message":[{"class":"Test\\Test"}]} 

Output in Graylog:

{"version":"1.1", "short_message":"class=Test\Test", "_time":"2024-11-22T16:28:55.518280367+03:00", "_stream":"stdout", "__p":"F", "timestamp":1732282135.518}

Steps to reproduce the problem:

1. Configure Fluent Bit with the GELF output plugin.
2. Send a log message containing double backslashes (\) in a string field.
3. Observe the output in Graylog where double backslashes are incorrectly replaced with single backslashes.

Expected behavior
Double backslashes (\) in the input message should be preserved in the output.

Your Environment

• Version used: 3.2.0
• Configuration:

[SERVICE]
    Flush        1
    Log_Level    info
    Daemon       off
    HTTP_Server  On
    HTTP_Listen  0.0.0.0
    HTTP_Port    2020
    parsers_file  /fluent-bit/etc/parsers.conf


[INPUT]
    Name              tail
    Tag               kube.*
    Path              /var/log/containers/*.log
    multiline.parser  cri
    Mem_Buf_Limit     50MB
    Skip_Long_Lines   On
    Skip_Empty_Lines  On

[FILTER]
    Name    parser
    Match   *
    Parser  json
    Key_Name log
    Unescape_Key False
    Reserve_Data True
    Preserve_Key False

[OUTPUT]
    Name    gelf
    Match   *
    Host    graylog.example.com
    Port    12201
    Mode    udp
    Gelf_Short_Message_Key message

• Filters and plugins: gelf, tail