logstash-filter-mutate icon indicating copy to clipboard operation
logstash-filter-mutate copied to clipboard

[BUG] Exception in Pipeline Causes Logstash to crash

Open Erni opened this issue 5 years ago • 0 comments

As an example, with a configuration like this one, we are trying to sanitize our URLs by removing any reference to the value in [@metadata][passwd] in lines like this:

mutate {
      gsub => [ "[location]", "sext2=%{[@metadata][passwd]}", "sext2=xxx" ]
      gsub => [ "[location]", "Password=%{[@metadata][passwd]}", "Password=xxx" ]
      gsub => [ "[location]", "password=%{[@metadata][passwd]}", "password=xxx" ]
    }

The crash bug can be reproduced when the password field contains a [.

To prevent the bug, we have to escape these metacharacters like this:

  mutate {
      gsub => [ "[@metadata][passwd]", "\)", "\\)" ]
      gsub => [ "[@metadata][passwd]", "\(", "\\(" ]
      gsub => [ "[@metadata][passwd]", "\*", "\\*" ]
      ...
    }

The problem is that Logstash crashes instead of just dropping the message.

Erni avatar Aug 09 '19 14:08 Erni