[BUG] Elasticsearch exporter decides bulk success by substring instead of the errors field #4295

Both export paths decide whether a bulk write succeeded by looking for a substring in the response body.

if (body_.find("\"failed\" : 0") == std::string::npos)

Three problems with that test.

failed is not the bulk outcome. In a bulk response, failed appears under _shards for an individual item. The result for the batch as a whole is the top level errors boolean. A body where one item has "failed": 0 and another item failed outright still matches the substring and is reported as a success.

It depends on pretty-printed spacing. The literal contains " : ". Elasticsearch only formats that way when the request asks for it, so a compact response never matches and a completely successful export is reported as a failure.

The asynchronous path ignores the HTTP status. AsyncResponseHandler::OnResponse only inspects the body, so a 4xx or 5xx with a body that happens to contain the substring is treated as a success. The synchronous path does check the status, in ResponseHandler::OnResponse.

Suggested fix

Parse the body and check the top level errors field, and check the HTTP status on both paths. nlohmann/json.hpp is already included by this file and already linked in both the CMake and Bazel targets, so this needs no new dependency. A malformed or unparseable body should count as a failure rather than being ignored.

I would like to work on this one.