logstash-plugins/logstash-filter-mutate

Crashes Logstash when using gsub with null value for regex replacement

SteveMB1 opened this issue · 0 comments

In short I'm looking to replace the matched regex with nothing. Each time this happens the Logstash worker thread restarts which causes large backlogs.

  • Version: Logstash 7.6.1
  • Operating System: RHEL 7.7
  • Config File (if you have sensitive info, please remove it): I'm using default settings for everything.
  • Sample Data: k8s_dockerapp-1_dockerapp-1
  • Steps to Reproduce:

Write the following to /etc/logstash/conf.d/01-listener.conf and try pushing data through the filter while monitoring the logstash logs with tail -f /var/log/logstash/logstash-*.

input {
  tcp {
    port => 10514
    codec => "json"
    type => "rsyslog"
  }
}

filter {
    mutate {
      gsub => [
        "program", "k8s_|_.*", ""
      ]
    }
}