Graylog2 / graylog-plugin-pipeline-processor

[DEPRECATED] Graylog Pipeline Message Processor Plugins
https://www.graylog.org/
GNU General Public License v3.0
20 stars 15 forks source link

select_jsonpath fails on missing json keys #232

Closed kroepke closed 6 years ago

kroepke commented 6 years ago

When using select_jsonpath to extract one or more values from a JSON object, the function does not handle missing values gracefully and will fail the entire rule.

The test introduced in #209 unfortunately looks like it tests for the correct behavior, but the test harness is not exactly the same as the production code.

Thus we need to filter out null values in the function itself. The NPE is an unfortunate sideeffect of the Java streams map collector, rather than the overall "null-ness" of a value in a map.