beats icon indicating copy to clipboard operation
beats copied to clipboard

decompress_gzip_field Failed to decompress field in decompress_gzip_field processor: error decompressing field message: gzip: invalid header

Open zez3 opened this issue 7 months ago • 4 comments

I am trying to decompress a message with the https://www.elastic.co/guide/en/beats/filebeat/current/decompress-gzip-field.html but it seems that it does not work. I get error decompressing field gzip: invalid header

The compression used for this field is unfortunately zlib forced by the following python lib: https://github.com/keeprocking/pygelf/blob/master/pygelf/gelf.py#L85

and the decompress-gzip-field seems to only accept gzip https://github.com/elastic/beats/blob/main/libbeat/processors/actions/decompress_gzip_field.go#L108

Please see the history here: https://stackoverflow.com/questions/20762094/how-are-zlib-gzip-and-zip-related-what-do-they-have-in-common-and-how-are-they

would be nice for decompress_gzip_field processor to accept zlib as well https://pkg.go.dev/compress/zlib

Love you

zez3 avatar Jun 27 '24 09:06 zez3