From 4f00e743f1c58e4e3743455fd3a086ddb3734860 Mon Sep 17 00:00:00 2001
From: alkamo <alkamo@gmail.com>
Date: Wed, 22 Sep 2021 10:46:39 -0400
Subject: [PATCH] Update index.js

* Changed Buffer.from so it did not have the inappropriate "new" keyword
* Changed the log decoding to use UTF-8 instead of ASCII to prevent the decode from failing if extended characters are present
---
 splunk-cloudwatch-logs-processor/index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/splunk-cloudwatch-logs-processor/index.js b/splunk-cloudwatch-logs-processor/index.js
index 256ccdb..2af2ab8 100644
--- a/splunk-cloudwatch-logs-processor/index.js
+++ b/splunk-cloudwatch-logs-processor/index.js
@@ -37,13 +37,13 @@ exports.handler = (event, context, callback) => {
     configureLogger(context, callback); // eslint-disable-line no-use-before-define
 
     // CloudWatch Logs data is base64 encoded so decode here
-    const payload = new Buffer.from(event.awslogs.data, 'base64');
+    const payload = Buffer.from(event.awslogs.data, 'base64');
     // CloudWatch Logs are gzip compressed so expand here
     zlib.gunzip(payload, (error, result) => {
         if (error) {
             callback(error);
         } else {
-            const parsed = JSON.parse(result.toString('ascii'));
+            const parsed = JSON.parse(result.toString('utf8'));
             console.log('Decoded payload:', JSON.stringify(parsed, null, 2));
             let count = 0;
             if (parsed.logEvents) {