search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.31k stars 1.05k forks source link

hide stacktrace / fail nice on unsuccessfull lookup #4932

Open jalogisch opened 6 years ago

jalogisch commented 6 years ago

Current Behavior

2018-07-18T09:24:39.262-04:00 WARN  [MaxmindDataAdapter] Unable to look up IP address, returning empty result.
java.lang.NullPointerException: null
        at org.graylog.plugins.map.geoip.MaxmindDataAdapter.doGet(MaxmindDataAdapter.java:150) ~[?:?]
        at org.graylog2.plugin.lookup.LookupDataAdapter.get(LookupDataAdapter.java:123) ~[graylog.jar:?]
        at org.graylog2.lookup.LookupTable.lambda$lookup$0(LookupTable.java:72) ~[graylog.jar:?]
        at org.graylog2.lookup.caches.NullCache.get(NullCache.java:66) [graylog.jar:?]
        at org.graylog2.lookup.LookupTable.lookup(LookupTable.java:72) [graylog.jar:?]
        at org.graylog2.lookup.LookupTableService$Function.lookup(LookupTableService.java:534) [graylog.jar:?]
        at org.graylog.plugins.pipelineprocessor.functions.lookup.Lookup.evaluate(Lookup.java:53) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.functions.lookup.Lookup.evaluate(Lookup.java:20) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.ast.expressions.FunctionExpression.evaluateUnsafe(FunctionExpression.java:63) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.ast.expressions.Expression.evaluate(Expression.java:41) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.ast.statements.VarAssignStatement.evaluate(VarAssignStatement.java:33) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.ast.statements.VarAssignStatement.evaluate(VarAssignStatement.java:22) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.evaluateStatement(PipelineInterpreter.java:377) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.executeRuleActions(PipelineInterpreter.java:364) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.evaluateStage(PipelineInterpreter.java:305) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.processForResolvedPipelines(PipelineInterpreter.java:263) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.process(PipelineInterpreter.java:143) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.process(PipelineInterpreter.java:99) [graylog-plugin-pipeline-processor-2.3.2.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.handleMessage(ProcessBufferProcessor.java:114) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.dispatchMessage(ProcessBufferProcessor.java:100) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:77) [graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:42) [graylog.jar:?]
        at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_65]

Possible Solution

Not every unsuccesfull lookup should produce a stacktrace like the above - that should be covered leaving only a single line with the lookup name that wasn't successfull and not like the above.

Your Environment

jalogisch commented 6 years ago

related: https://github.com/Graylog2/graylog-plugin-map-widget/issues/67

jalogisch commented 6 years ago

reference: https://community.graylog.org/t/lot-of-unprocessed-messages/6600/3?u=jan

it is hard to read and understand what the issue is and if this is critical or not.