search

elastic / logstash-filter-elastic_integration

The Elastic Integrations filter for Logstash, which enables running Elastic Integrations inside of Logstash pipelines
Other
2 stars 9 forks source link

[Bug]: pipelines with painless scripts referencing org.elasticsearch.ingest.common.Processors fail to compile #161

Closed yaauie closed 1 month ago

yaauie commented 1 month ago

Plugin Version

0.1.13

Logstash Version

8.14.3

Java Version

openjdk version "17.0.10" 2024-01-16 OpenJDK Runtime Environment (build 17.0.10+7-Ubuntu-120.04.1) OpenJDK 64-Bit Server VM (build 17.0.10+7-Ubuntu-120.04.1, mixed mode, sharing) Operating System: Ubuntu 20.04.6 LTS

Host Info

No response

What happened?

An event activating the logs-aws.cloudtrail integration failed to compile the retrieved pipeline because it references Processors#lowercase(String) (presumably org.elasticsearch.ingest.common.Processors#lowercase(String)) in a painless script.

[2024-09-09T19:49:57,532][ERROR][co.elastic.logstash.filters.elasticintegration.IngestPipelineFactory][agent-default] failed to create ingest pipeline `logs-aws.cloudtrail-2.24.0` from pipeline configuration
org.elasticsearch.script.ScriptException: compile error
  at org.elasticsearch.painless.PainlessScriptEngine.convertToScriptException(PainlessScriptEngine.java:502) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.PainlessScriptEngine.compile(PainlessScriptEngine.java:412) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.PainlessScriptEngine.compile(PainlessScriptEngine.java:132) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.script.ScriptCache.lambda$compile$0(ScriptCache.java:108) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.common.cache.Cache.computeIfAbsent(Cache.java:439) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.script.ScriptCache.compile(ScriptCache.java:90) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.script.ScriptService.compile(ScriptService.java:634) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.ingest.common.ScriptProcessor$Factory.create(ScriptProcessor.java:124) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.ingest.common.ScriptProcessor$Factory.create(ScriptProcessor.java:95) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.ingest.ConfigurationUtils.readProcessor(ConfigurationUtils.java:615) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.ingest.ConfigurationUtils.readProcessor(ConfigurationUtils.java:579) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.ingest.ConfigurationUtils.readProcessorConfigs(ConfigurationUtils.java:499) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.ingest.Pipeline.create(Pipeline.java:98) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at co.elastic.logstash.filters.elasticintegration.IngestPipelineFactory.create(IngestPipelineFactory.java:49) ~[logstash-filter-elastic_integration-0.1.13.jar:?]

[...]

Caused by: java.lang.IllegalArgumentException: cannot resolve symbol [Processors]
  at org.elasticsearch.painless.PainlessScript$Script.compile(ctx.event.kind = 'event'; ctx.event.type = ['info']; ...:427) ~[?:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitCall(DefaultSemanticAnalysisPhase.java:3232) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitCall(DefaultSemanticAnalysisPhase.java:160) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.node.ECall.visit(ECall.java:63) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.checkedVisit(DefaultSemanticAnalysisPhase.java:199) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitAssignment(DefaultSemanticAnalysisPhase.java:1072) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitAssignment(DefaultSemanticAnalysisPhase.java:160) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.node.EAssignment.visit(EAssignment.java:62) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.checkedVisit(DefaultSemanticAnalysisPhase.java:199) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.PainlessSemanticAnalysisPhase.visitExpression(PainlessSemanticAnalysisPhase.java:124) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.PainlessSemanticAnalysisPhase.visitExpression(PainlessSemanticAnalysisPhase.java:46) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.node.SExpression.visit(SExpression.java:35) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visit(DefaultSemanticAnalysisPhase.java:188) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitBlock(DefaultSemanticAnalysisPhase.java:329) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitBlock(DefaultSemanticAnalysisPhase.java:160) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.node.SBlock.visit(SBlock.java:37) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visit(DefaultSemanticAnalysisPhase.java:188) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitIf(DefaultSemanticAnalysisPhase.java:379) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitIf(DefaultSemanticAnalysisPhase.java:160) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.node.SIf.visit(SIf.java:41) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visit(DefaultSemanticAnalysisPhase.java:188) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitBlock(DefaultSemanticAnalysisPhase.java:329) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitBlock(DefaultSemanticAnalysisPhase.java:160) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.node.SBlock.visit(SBlock.java:37) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visit(DefaultSemanticAnalysisPhase.java:188) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.PainlessSemanticAnalysisPhase.visitFunction(PainlessSemanticAnalysisPhase.java:91) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.phase.DefaultSemanticAnalysisPhase.visitClass(DefaultSemanticAnalysisPhase.java:233) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.Compiler.compile(Compiler.java:216) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.PainlessScriptEngine$2.run(PainlessScriptEngine.java:404) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at org.elasticsearch.painless.PainlessScriptEngine$2.run(PainlessScriptEngine.java:400) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  at java.security.AccessController.doPrivileged(AccessController.java:399) ~[?:?]
  at org.elasticsearch.painless.PainlessScriptEngine.compile(PainlessScriptEngine.java:400) ~[logstash-filter-elastic_integration-0.1.13.jar:?]
  ... 32 more