From ca62654dd06a5da2fb9e87163c9d7eab8f91a667 Mon Sep 17 00:00:00 2001 From: Jorge Cruz <1081844+d1g1tal-lore-34@users.noreply.github.com> Date: Fri, 24 Oct 2025 18:12:33 -0500 Subject: [PATCH 1/5] fix(azure): Resolve properties field issue, that contains JSON string with single quotes --- azure/activity_logs_monitoring/index.js | 26 ++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/azure/activity_logs_monitoring/index.js b/azure/activity_logs_monitoring/index.js index d7bde7d3f..907f35324 100644 --- a/azure/activity_logs_monitoring/index.js +++ b/azure/activity_logs_monitoring/index.js @@ -381,7 +381,7 @@ class EventhubLogHandler { this.records.push(originalRecord); } } else { - this.records.push(originalRecord); + this.records.push(this.fixPropertiesJsonString(originalRecord)); } } else { record = this.addTagsToStringLog(record); @@ -389,6 +389,30 @@ class EventhubLogHandler { } } + fixPropertiesJsonString(record) { + try { + // Check if properties field is a string + if (typeof record.properties === 'string') { + // If it is a string, check if it is a malformed JSON String + // By checking for ':' + if (record.properties.includes("':'")) { + // If the check is true, find / replace single quotes + // with double quotes, to make a proper JSON + // which is then converted into a JSON Object + record.properties = JSON.parse(record.properties.replace(/'/g, '"')); + return record; + }else { + return record; + } + } else { + return record; + } + } catch { + this.context.error('Unable to fix properties field to JSON Object'); + return record; + } + } + handleLogs(logs) { let logsType = this.getLogFormat(logs); switch (logsType) { From 4411f197025a3873f8f10a8a787b5c1e3a87ffee Mon Sep 17 00:00:00 2001 From: Jorge Cruz <1081844+d1g1tal-lore-34@users.noreply.github.com> Date: Fri, 24 Oct 2025 19:05:35 -0500 Subject: [PATCH 2/5] Added test cases, for fixPropertiesJsonString for code coverage --- azure/test/activity_logs_monitoring.test.js | 34 +++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/azure/test/activity_logs_monitoring.test.js b/azure/test/activity_logs_monitoring.test.js index ecb2d5d0d..67372ff1f 100644 --- a/azure/test/activity_logs_monitoring.test.js +++ b/azure/test/activity_logs_monitoring.test.js @@ -818,3 +818,37 @@ describe('Log Splitting', function() { }); }); }); +describe('EventhubLogHandler Fix Properties Json String', function() { + + beforeEach(function() { + this.forwarder = setUp(); + }); + + it('parses properties string with single quotes into object', function() { + const record = { properties: "{'key':'value'}" }; + const result = this.forwarder.fixPropertiesJsonString(record); + assert.equal( + 'object', + typeof result.properties + ) + }); + + it("leaves properties string unchanged when it doesn't match the malformed pattern", function() { + const record = { properties: 'some plain string without colons' }; + const result = this.forwarder.fixPropertiesJsonString(record); + assert.equal( + 'string', + typeof result.properties + ) + }); + + it('logs an error and returns original record when replacement results in invalid JSON', function() { + // includes the "':'" marker so the function attempts replacement, but JSON remains invalid + const badRecord = { properties: "Look i know i shouldn't but, i will do this ':' " }; + const result = this.forwarder.fixPropertiesJsonString(badRecord); + assert.equal( + 'string', + typeof result.properties + ) + }); +}); From 486d79ecff0797964f20042c83994f84ffbe2777 Mon Sep 17 00:00:00 2001 From: Jo <1081844+d1g1tal-lore-34@users.noreply.github.com> Date: Tue, 28 Oct 2025 18:51:02 -0500 Subject: [PATCH 3/5] Applied recommendation from mattsp1290, which simplifies the if condition Co-authored-by: Matt Spurlin --- azure/activity_logs_monitoring/index.js | 31 +++++++++---------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/azure/activity_logs_monitoring/index.js b/azure/activity_logs_monitoring/index.js index 907f35324..055f38586 100644 --- a/azure/activity_logs_monitoring/index.js +++ b/azure/activity_logs_monitoring/index.js @@ -390,27 +390,18 @@ class EventhubLogHandler { } fixPropertiesJsonString(record) { - try { - // Check if properties field is a string - if (typeof record.properties === 'string') { - // If it is a string, check if it is a malformed JSON String - // By checking for ':' - if (record.properties.includes("':'")) { - // If the check is true, find / replace single quotes - // with double quotes, to make a proper JSON - // which is then converted into a JSON Object - record.properties = JSON.parse(record.properties.replace(/'/g, '"')); - return record; - }else { - return record; - } - } else { - return record; + // Check if properties field is a malformed JSON String + if (Object.hasOwn(record, 'properties') && (typeof record.properties === 'string') && (record.properties.includes("':'"))) { + try { + // If the check is true, find and replace single quotes + // with double quotes, to make a proper JSON + // which is then converted into a JSON Object + parsedProperties = JSON.parse(record.properties.replace(/'/g, '"')); + record.properties = parsedProperties; + } catch { + this.context.error('Unable to fix properties field to JSON Object'); } - } catch { - this.context.error('Unable to fix properties field to JSON Object'); - return record; - } + return record; } handleLogs(logs) { From e37c2a18f285114f36b3f4413dbbf904be99e4fa Mon Sep 17 00:00:00 2001 From: Jorge Cruz <1081844+d1g1tal-lore-34@users.noreply.github.com> Date: Tue, 28 Oct 2025 19:16:07 -0500 Subject: [PATCH 4/5] Finalized the simplified function, added missing return statements --- azure/activity_logs_monitoring/index.js | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/azure/activity_logs_monitoring/index.js b/azure/activity_logs_monitoring/index.js index 055f38586..a4ce4cb40 100644 --- a/azure/activity_logs_monitoring/index.js +++ b/azure/activity_logs_monitoring/index.js @@ -396,12 +396,15 @@ class EventhubLogHandler { // If the check is true, find and replace single quotes // with double quotes, to make a proper JSON // which is then converted into a JSON Object - parsedProperties = JSON.parse(record.properties.replace(/'/g, '"')); - record.properties = parsedProperties; + record.properties = JSON.parse(record.properties.replace(/'/g, '"')); + return record; } catch { this.context.error('Unable to fix properties field to JSON Object'); + return record; } - return record; + } else { + return record; + } } handleLogs(logs) { From 9867288fa47c5fac657482e96c66de95dfb1bb4b Mon Sep 17 00:00:00 2001 From: Jorge Cruz <1081844+d1g1tal-lore-34@users.noreply.github.com> Date: Tue, 28 Oct 2025 19:16:45 -0500 Subject: [PATCH 5/5] Added additional test cases for fixPropertiesJsonString, that handles nested objects and no properties field --- azure/test/activity_logs_monitoring.test.js | 47 +++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/azure/test/activity_logs_monitoring.test.js b/azure/test/activity_logs_monitoring.test.js index 67372ff1f..fe49ccd08 100644 --- a/azure/test/activity_logs_monitoring.test.js +++ b/azure/test/activity_logs_monitoring.test.js @@ -827,6 +827,43 @@ describe('EventhubLogHandler Fix Properties Json String', function() { it('parses properties string with single quotes into object', function() { const record = { properties: "{'key':'value'}" }; const result = this.forwarder.fixPropertiesJsonString(record); + + const expectedProperties = { properties: { key: "value" } }; + + assert.deepEqual( + expectedProperties, + result + ); + assert.equal( + 'object', + typeof result.properties + ) + }); + + it('parses object that doesnt have properties', function() { + const record = { hostname: "server_name", subObject: { key:"value"} }; + const result = this.forwarder.fixPropertiesJsonString(record); + + assert.deepEqual( + record, + result + ); + assert.equal( + 'object', + typeof result + ) + }); + + it('parses properties string with nested objects', function() { + const record = { properties: "{'key':'value','subObj':{ 'subKey' : 'subValue' }}" }; + const result = this.forwarder.fixPropertiesJsonString(record); + + const expectedProperties = { properties: { key: "value", subObj: { subKey: "subValue"} } }; + + assert.deepEqual( + expectedProperties, + result + ); assert.equal( 'object', typeof result.properties @@ -836,6 +873,11 @@ describe('EventhubLogHandler Fix Properties Json String', function() { it("leaves properties string unchanged when it doesn't match the malformed pattern", function() { const record = { properties: 'some plain string without colons' }; const result = this.forwarder.fixPropertiesJsonString(record); + + assert.deepEqual( + record, + result + ); assert.equal( 'string', typeof result.properties @@ -846,6 +888,11 @@ describe('EventhubLogHandler Fix Properties Json String', function() { // includes the "':'" marker so the function attempts replacement, but JSON remains invalid const badRecord = { properties: "Look i know i shouldn't but, i will do this ':' " }; const result = this.forwarder.fixPropertiesJsonString(badRecord); + + assert.deepEqual( + badRecord, + result + ); assert.equal( 'string', typeof result.properties