Closed jordansissel closed 8 years ago
We could also have some heuristics to scan the user defined grok pattern to look for smells like use of greedy patterns (e.g. .*
), and/or uses of GREEDYDATA
in the middle of said pattern
As an example of a regexp that executes poorly, here: https://github.com/jordansissel/experiments/blob/master/ruby/regexp/interrupt.rb#L3-L7
It's what I was using at the time to test a patch to Joni to make it interruptible.
@jordansissel should we also tag this with a _grokparsefailure
?
any chance that the incriminated regex can be printed out?
Perhaps related - I just can't see why this grok-pattern would time out: https://github.com/logstash-plugins/logstash-filter-grok/issues/99
@nellicus can you open that up as a new ticket and link it here? Good idea!
done @andrewvc thanks
JRuby's Joni supports Java's
Thread.interrupted()
, so we have an option to interrupt long-running groks. Given some recent rise in reports of ReDoS's in grok that I've seen, I think we could make an option in grok to terminate a match if it takes longer than some configured timeout.Proposal:
timeout
- time after which to cancel the execution of a regexp.tag_on_timeout
string.timeout
of 2 seconds of wallclock timetag_on_timeout
to_groktimeout