search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
12.2k stars 4.93k forks source link

[filebeat] kafka input panics if `expand_event_list_from_field` points to field that isn't an array #36684

Open leehinman opened 1 year ago

leehinman commented 1 year ago

If the kafka input has:

filebeat.inputs:
- type: kafka
  expand_event_list_from_field: records

And the records field is not an array (say a string). The code at https://github.com/elastic/beats/blob/58db08f2bf76e124b46c28118148afe45f55c577/filebeat/input/kafka/input.go#L422 returns an empty slice. But later on this code tries to compose messages from this slice and it attempts to index into the 0 length slice here. That leads to a panic.

jlind23 commented 1 year ago

@leehinman according to Beats CODEOWNERS file, this input belongs to @elastic/obs-infraobs-integrations, forwarding this to them.

faec commented 1 year ago

Updating team assignment -- the Kafka module is owned by Integrations, but according to CODEOWNERS (and unless I missed the change) the input itself is still owned by Agent's data plane.

botelastic[bot] commented 3 weeks ago

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!