[awslogs_encoding] Parse invalid request field in ELB access logs (#44475)

<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description
Parses invalid requests logged by ELB logs

<!-- Issue number (e.g. #1234) or full URL to issue, if applicable. -->
#### Link to tracking issue
Fixes #44233 

<!--Describe what testing was performed and which tests were added.-->
#### Testing

Added tests for function `parseRequestField(raw string) (method, uri,
protoName, protoVersion string, err error)`

---------

Signed-off-by: Kavindu Dodanduwa <[email protected]>
Co-authored-by: Kavindu Dodanduwa <[email protected]>
Co-authored-by: Kavindu Dodanduwa <[email protected]>

Author: piffall

.chloggen/issue-44233-parse-invalid-request-in-elbaccess-logs.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/filelog)
+component: extension/awslogs_encoding
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "Fix ALB log `request_line` parsing for valid formats and avoid errors"
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [44233]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

extension/encoding/awslogsencodingextension/internal/unmarshaler/elb-access-log/elb.go

@@ -488,32 +488,40 @@ func extractFields(logLine string) ([]string, error) {
 func parseRequestField(raw string) (method, uri, protoName, protoVersion string, err error) {
 	method, remaining, _ := strings.Cut(raw, " ")
 	if method == "" {
-		err = fmt.Errorf("unexpected: request field %q has no method", raw)
+		err = fmt.Errorf("unexpected: field %q has no method section", raw)
 		return method, uri, protoName, protoVersion, err
 	}
 
-	uri, remaining, _ = strings.Cut(remaining, " ")
-	if uri == "" {
-		err = fmt.Errorf("unexpected: request field %q has no URI", raw)
-		return method, uri, protoName, protoVersion, err
-	}
+	var protocol string
 
-	protocol, leftover, _ := strings.Cut(remaining, " ")
-	if protocol == "" || leftover != "" {
-		err = fmt.Errorf(`request field %q does not match expected format "<method> <uri> <protocol>"`, raw)
+	index := strings.LastIndex(remaining, " ")
+	switch {
+	case index == -1:
+		err = fmt.Errorf("unexpected: field %q has no protocol/version section", raw)
 		return method, uri, protoName, protoVersion, err
+	case index == len(remaining)-1:
+		uri = strings.TrimSpace(remaining)
+		protocol = unknownField
+	default:
+		uri = remaining[:index]
+		protocol = remaining[index+1:]
 	}
 
 	protoName, protoVersion, err = netProtocol(protocol)
 	if err != nil {
 		err = fmt.Errorf("invalid protocol in request field: %w", err)
 		return method, uri, protoName, protoVersion, err
 	}
-	return method, uri, protoName, protoVersion, err
+
+	return method, uri, protoName, protoVersion, nil
 }
 
 // netProtocol returns protocol name and version based on proto value
 func netProtocol(proto string) (string, string, error) {
+	if proto == unknownField {
+		return unknownField, unknownField, nil
+	}
+
 	name, version, found := strings.Cut(proto, "/")
 	if !found || name == "" || version == "" {
 		return "", "", errors.New(`request uri protocol does not follow expected scheme "<name>/<version>"`)

extension/encoding/awslogsencodingextension/internal/unmarshaler/elb-access-log/elb_test.go

@@ -59,3 +59,84 @@ func Test_scanField(t *testing.T) {
 		})
 	}
 }
+
+func Test_parseRequestField(t *testing.T) {
+	tests := []struct {
+		name             string
+		input            string
+		wantMethod       string
+		wantURI          string
+		wantProtoName    string
+		wantProtoVersion string
+		wantErr          bool
+	}{
+		{
+			name:             "Valid input with expected sections",
+			input:            "GET http://example.com/ HTTP/1.1",
+			wantMethod:       "GET",
+			wantURI:          "http://example.com/",
+			wantProtoName:    "http",
+			wantProtoVersion: "1.1",
+		},
+		{
+			name:             "Missing protocol/version",
+			input:            "GET http://example.com/ -",
+			wantMethod:       "GET",
+			wantURI:          "http://example.com/",
+			wantProtoName:    "-",
+			wantProtoVersion: "-",
+		},
+		{
+			name:             "URI section with spaces",
+			input:            "GET http://example.com/path to somewhere HTTP/1.1",
+			wantMethod:       "GET",
+			wantURI:          "http://example.com/path to somewhere",
+			wantProtoName:    "http",
+			wantProtoVersion: "1.1",
+		},
+		{
+			name:             "Input with spaces and missing protocol/version",
+			input:            "- http://example.com/path to somewhere- -",
+			wantMethod:       "-",
+			wantURI:          "http://example.com/path to somewhere-",
+			wantProtoName:    "-",
+			wantProtoVersion: "-",
+		},
+		{
+			name:             "Missing method and protocol/version",
+			input:            "- http://example.com:80- ",
+			wantErr:          false,
+			wantMethod:       "-",
+			wantURI:          "http://example.com:80-",
+			wantProtoName:    "-",
+			wantProtoVersion: "-",
+		},
+		{
+			name:       "Invalid input with missing expected sections",
+			input:      "GET /",
+			wantMethod: "GET",
+			wantErr:    true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotMethod, gotURI, gotProtoName, gotProtoVersion, err := parseRequestField(tt.input)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parseRequestField() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if gotMethod != tt.wantMethod {
+				t.Errorf("parseRequestField() gotMethod = %v, want %v", gotMethod, tt.wantMethod)
+			}
+			if gotURI != tt.wantURI {
+				t.Errorf("parseRequestField() gotURI = %v, want %v", gotURI, tt.wantURI)
+			}
+			if gotProtoName != tt.wantProtoName {
+				t.Errorf("parseRequestField() gotProtoName = %v, want %v", gotProtoName, tt.wantProtoName)
+			}
+			if gotProtoVersion != tt.wantProtoVersion {
+				t.Errorf("parseRequestField() gotProtoVersion = %v, want %v", gotProtoVersion, tt.wantProtoVersion)
+			}
+		})
+	}
+}