logstash-plugins/logstash-input-beats

payloads with improperly-used reserved fields cause runtime errors

yaauie opened this issue · 0 comments

Consider the following filebeat.yml, which configures Filebeat to send payloads with the root-level @metadata field to be false.

filebeat.inputs:
  - type: log
    paths:
      - ...
    fields:
      "@metadata": false
    fields_under_root: true

This plugin decodes the given field from the payload and creates the event with @metadata set to false, but then throws a runtime exception when this plugin attempts to add key/value pairs to the @metadata:

org.jruby.exceptions.NoMethodError: (NoMethodError) undefined method `[]=' for false:FalseClass
	at [${LOGSTASH_HOME}].vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_beats_minus_6_dot_0_dot_9_minus_java.lib.logstash.inputs.beats.message_listener.onNewMessage(${LOGSTASH_HOME}/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.0.9-java/lib/logstash/inputs/beats/message_listener.rb:34) ~[?:?]

I believe we should guard against improper use of reserved fields, or at least log a warning. A separate issue around documenting reserved fields may be a useful reference: elastic/logstash#11946