search

corelight / ecs-logstash-mappings

Mapping Corelight or Zeek data to Elastic Common Schema logs
BSD 3-Clause "New" or "Revised" License
12 stars 6 forks source link

Exception caught while applying mutate filter #35

Closed hsportel closed 11 months ago

hsportel commented 11 months ago

Hi,

I am getting mutate filter warnings on a logstash version 8.11.1 so it seems (for now) on two pipeline files:

snippet from the /var/log/logstash/logstash-plain.log

[2023-11-28T14:05:16,551][WARN ][logstash.filters.mutate ][main][filter-mutate-e98caa7068b3] Exception caught while applying mutate filter {:exception=>"can't modify frozen String"} [2023-11-28T14:05:16,871][WARN ][logstash.filters.mutate ][main][filter-mutate-1e85f5a781ad] Exception caught while applying mutate filter {:exception=>"can't modify frozen String"} [2023-11-28T14:05:21,563][WARN ][logstash.filters.mutate ][main][filter-mutate-e98caa7068b3] Exception caught while applying mutate filter {:exception=>"can't modify frozen String"} [2023-11-28T14:05:21,880][WARN ][logstash.filters.mutate ][main][filter-mutate-1e85f5a781ad] Exception caught while applying mutate filter {:exception=>"can't modify frozen String"} [2023-11-28T14:05:26,571][WARN ][logstash.filters.mutate ][main][filter-mutate-e98caa7068b3] Exception caught while applying mutate filter {:exception=>"can't modify frozen String"} [2023-11-28T14:05:26,889][WARN ][logstash.filters.mutate ][main][filter-mutate-1e85f5a781ad] Exception caught while applying mutate filter {:exception=>"can't modify frozen String"}

grep -rli "filter-mutate-e98caa7068b3" /etc/logstash/conf.d/CorelightPipelines 3111-corelight-ecs-dns-filter.conf

grep -rli "filter-mutate-1e85f5a781ad" /etc/logstash/conf.d/CorelightPipelines 3111-corelight-ecs-conn-filter.conf

Thanks in advance Cheers Herman

hunter32me commented 11 months ago

We have a temporary fix till the new pipelines come out very soon starting in Logstash 8.10 this bug show up

Comment out the following in DNS and conn pipelines Conn - 3111-corelight-ecs-conn-filter.conf lines 63- 66 convert => { "[conn][local_orig]" => "string" "[conn][local_resp]" => "string" } 3111-corelight-ecs-dns-filter.conf Comment out line 37 -44 convert => { "[dns][flags][authoritative]" => "string" "[dns][flags][recursion][available]" => "string" "[dns][flags][recursion][desired]" => "string" "[dns][flags][truncated][response]" => "string" "[dns][flags][rejected]" => "string" "[dns][flags][z_bit]" => "string" }

hsportel commented 11 months ago

Awesome, that did the trick, thanks for quick response. cheers