search

logstash-plugins / logstash-filter-mutate

Apache License 2.0
16 stars 75 forks source link

Mixed kinds of rename option in single mutate filter doesn't work #159

Open tasneem-hyder opened 3 years ago

tasneem-hyder commented 3 years ago

Logstash information:

  1. Logstash version Using JAVA_HOME defined java: /usr/local/opt/openjdk@11/libexec/openjdk.jdk/Contents/Home logstash 7.13.1

  2. Logstash installation source Mac homebrew

  3. How is Logstash being run via command line

OS version (uname -a if on a Unix-like system): Darwin 18.7.0 Darwin Kernel Version 18.7.0: Tue Jan 12 22:04:47 PST 2021; root:xnu-4903.278.56~1/RELEASE_X86_64 x86_64

Issue An issue which is seen during pipeline runtime although Logstash could have reported during application startup on configuration verification. I am aware that mutate rename option expects Hash but having Array only also works. So, the problem occurs when someone use both kinds hash and array ( added example in elastic discuss link) in single filter because Logstash doesn't report it as Invalid configuration setup. This setup is also not captured in configuration verification -t option where it thinks it as Valid, but it is not during runtime. Details here https://discuss.elastic.co/t/mixed-kinds-of-rename-option-in-single-mutate-filter-wont-work/283278

tasneem-hyder commented 3 years ago

I was wondering how we had lots of Logstash configurations file with input as array in rename and after doing repo issue scan , I found this..

Actually, the Array input type still work when we use single elements, but it has issues when we use mixed setup mentioned here. This become issue for those who have been using Array input type because it works but suddenly noticed the Hash input type and somehow tried to use both in one filter.

Although the document is updated but this is widely used.