Closed dayotoro closed 2 years ago
When I request an API with an empty body response, the filter crashes and the pipeline is interrupted
Here the error message :
| [2022-04-20T07:46:02,164][ERROR][logstash.javapipeline ] Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"Test", :error=>"(NoMethodError) undefined method `strip' for nil:NilClass", :exception=>Java::OrgJrubyExceptions::NoMethodError, :backtrace=>["usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_filter_minus_http_minus_1_dot_0_dot_2.lib.logstash.filters.http.process_response(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-http-1.0.2/lib/logstash/filters/http.rb:116)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_filter_minus_http_minus_1_dot_0_dot_2.lib.logstash.filters.http.filter(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-http-1.0.2/lib/logstash/filters/http.rb:76)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.do_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.multi_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "usr.share.logstash.logstash_minus_core.lib.logstash.filters.base.multi_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.multi_filter(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:293)"], :thread=>"#<Thread:0x610d43eb sleep>"}
To solve this issue, I have modified the code in lib\logstash\filters\http.rb and added theses lines :
if body.nil? body = "" end
After the line 136 in http.rb (after "event.set(@target_headers, headers)" before "if content_type == "application/json"").
Maybe other users have the same issue, so it could be a good idea to add this code to the plugin, or any other method to manage this case
If you what to reproduce, the Kibana API to delete a case doesn't reponse with a body. Doc: https://www.elastic.co/guide/en/security/current/cases-api-delete-case.html
Duplicate #25 I Close
dayotoro
commented
2 years ago dayotoro
commented
2 years ago
When I request an API with an empty body response, the filter crashes and the pipeline is interrupted
Here the error message :
To solve this issue, I have modified the code in lib\logstash\filters\http.rb and added theses lines :
After the line 136 in http.rb (after "event.set(@target_headers, headers)" before "if content_type == "application/json"").
Maybe other users have the same issue, so it could be a good idea to add this code to the plugin, or any other method to manage this case
If you what to reproduce, the Kibana API to delete a case doesn't reponse with a body. Doc: https://www.elastic.co/guide/en/security/current/cases-api-delete-case.html