grok_exporter icon indicating copy to clipboard operation
grok_exporter copied to clipboard

Bug: JSON selector not found leads to excessive logging and incorrect metric generation

Open thomas315 opened this issue 3 years ago • 0 comments

When webhook_format: json_bulk or json_lines is used there are cases in which matches and metric creation are not working correctly. Additionally the whole request body is getting logged in

level=warning msg="Unable to find selector path" post_body="<request body>" webhook_json_selector=.requesterDN

Grok exporter version: v1.0.0.RC5

configuration file:

global:
  config_version: 3
input:
  type: webhook
  webhook_path: /webhook
  webhook_format: json_lines
  webhook_json_selector: .requesterDN

server:
  port: 9144

metrics:
  - type: counter
    name: metric_name_count
    help: something
    match: 'john'

Case 1:

What did you do?

curl -X POST -H "Content-Type: application/json" -d '{ "logtype":"access", "requesterDN":"john" }
{ "logtype":"access", "requesterDN":"mark" }' http://localhost:9146/webhook

or

curl -X POST -H "Content-Type: application/json" -d '{ "logtype":"access", "requesterDN":"mark" }
{ "logtype":"access", "requesterDN":"john" }' http://localhost:9146/webhook

What did you expect to see? grok_exporter_lines_total{status="ignored"} = 1 grok_exporter_lines_total{status="matched"} = 1

What did you see instead? Under which circumstances? this works as expected!

Case 2:

What did you do?

curl -X POST -H "Content-Type: application/json" -d '{ "logtype":"access" }
{ "logtype":"access", "requesterDN":"john" }' http://localhost:9146/webhook

What did you expect to see? grok_exporter_lines_total{status="ignored"} = 0 # discussable if it this metric should be increased if there is no JSON selector found grok_exporter_lines_total{status="matched"} = 1

What did you see instead? Under which circumstances? grok_exporter_lines_total{status="ignored"} = 0 grok_exporter_lines_total{status="matched"} = 0

Log:

level=warning msg="Unable to find selector path" post_body="{ \"logtype\":\"access\" }\n{ \"logtype\":\"access\", \"requesterDN\":\"john\" }" webhook_json_selector=.requesterDN

Case 3:

What did you do?

curl -X POST -H "Content-Type: application/json" -d '{ "logtype":"access", "requesterDN":"john" }
{ "logtype":"access" } ' http://localhost:9146/webhook

What did you expect to see? grok_exporter_lines_total{status="ignored"} = 0 grok_exporter_lines_total{status="matched"} = 1

What did you see instead? Under which circumstances? grok_exporter_lines_total{status="ignored"} = 0 # discussable if it this metric should be increased if there is no JSON selector found grok_exporter_lines_total{status="matched"} = 1 Metrics are correctly increased in this case.

Logs:

level=warning msg="Unable to find selector path" post_body="{ \"logtype\":\"access\", \"requesterDN\":\"john\" }\n{ \"logtype\":\"access\" } " webhook_json_selector=.requesterDN

Same log as for Case 2 but correct increased metrics.

thomas315 avatar Jun 25 '21 13:06 thomas315