logstash crash with "IndexError: string not matched" Exception
toopa2002 opened this issue · 0 comments
Logstash process crash when using "json" filter to expands json data which is has "[" and "]" as key as below Sample Data. It create exception as below.
{
:timestamp=>"2017-02-08T14:20:29.531000+0000",
:message=>"Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.",
"exception"=>#<IndexError: string not matched>,
"backtrace"=>["org/jruby/RubyString.java:3910:in[]='", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.3-java/lib/logstash/util/accessors.rb:64:in
set'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.3-java/lib/logstash/event.rb:136:in[]='", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-json-2.0.6/lib/logstash/filters/json.rb:101:in
filter'",
"org/jruby/RubyHash.java:1342:ineach'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-json-2.0.6/lib/logstash/filters/json.rb:101:in
filter'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/filters/base.rb:151:inmulti_filter'", "org/jruby/RubyArray.java:1613:in
each'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/filters/base.rb:148:inmulti_filter'", "(eval):901006:in
initialize'",
"org/jruby/RubyArray.java:1613:ineach'", "(eval):901003:in
initialize'",
"org/jruby/RubyProc.java:281:incall'", "(eval):901023:in
initialize'",
"org/jruby/RubyArray.java:1613:ineach'", "(eval):901020:in
initialize'",
"org/jruby/RubyProc.java:281:incall'", "(eval):902385:in
initialize'",
"org/jruby/RubyArray.java:1613:ineach'", "(eval):902244:in
initialize'",
"org/jruby/RubyProc.java:281:incall'", "(eval):85736:in
filter_func'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/pipeline.rb:267:infilter_batch'", "org/jruby/RubyArray.java:1613:in
each'",
"org/jruby/RubyEnumerable.java:852:ininject'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/pipeline.rb:265:in
filter_batch'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/pipeline.rb:223:inworker_loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.3-java/lib/logstash/pipeline.rb:201:in
start_workers'"],
:level=>:error
}
- Config File (if you have sensitive info, please remove it):
json {
source => "message"
}
- Sample Data:
{
"message": ""baseFields[fIndex]": "xxx","baseFields[fIndex].OverrideField.Name":"DTSubjectName"",
"uuid" : "1234"
}
- Steps to Reproduce:
Run logstash with above configuration and send the sample data.