logstash-plugins/logstash-filter-mutate

Mixed kinds of rename option in single mutate filter doesn't work

tasneem-hyder opened this issue · 1 comments

Logstash information:

  1. Logstash version
    Using JAVA_HOME defined java: /usr/local/opt/openjdk@11/libexec/openjdk.jdk/Contents/Home
    logstash 7.13.1

  2. Logstash installation source
    Mac homebrew

  3. How is Logstash being run
    via command line

OS version (uname -a if on a Unix-like system):
Darwin 18.7.0 Darwin Kernel Version 18.7.0: Tue Jan 12 22:04:47 PST 2021; root:xnu-4903.278.56~1/RELEASE_X86_64 x86_64

Issue
An issue which is seen during pipeline runtime although Logstash could have reported during application startup on configuration verification. I am aware that mutate rename option expects Hash but having Array only also works. So, the problem occurs when someone use both kinds hash and array ( added example in elastic discuss link) in single filter because Logstash doesn't report it as Invalid configuration setup. This setup is also not captured in configuration verification -t option where it thinks it as Valid, but it is not during runtime.
Details here
https://discuss.elastic.co/t/mixed-kinds-of-rename-option-in-single-mutate-filter-wont-work/283278

I was wondering how we had lots of Logstash configurations file with input as array in rename and after doing repo issue scan , I found this..

Actually, the Array input type still work when we use single elements, but it has issues when we use mixed setup mentioned here. This become issue for those who have been using Array input type because it works but suddenly noticed the Hash input type and somehow tried to use both in one filter.

Although the document is updated but this is widely used.