OpenSearch-Dashboards
OpenSearch-Dashboards copied to clipboard
[BUG] v2.12.0 Discover Search Error with specific document data
Describe the bug After upgrade to OpenSearch Dashboards v2.12.0, Discover when viewing a logstash-* index pattern would fail with Search Error SyntaxError: Expected ',' or '}' after property value in JSON at position 325 (line 1 column 326) at fetch_Fetch.fetchResponse (http://localhost:5601/7326/bundles/core/core.entry.js:15:191557) at async interceptResponse (http://loocalhost:5601/7326/bundles/core/core.entry.js:15:186457) at async http://localhost:5601/7326/bundles/core/core.entry.js:15:189424
This only occurred when documents from one logging source were returned in the search results.
It appears to be triggered by a long number in the message, when it is surrounded by commas.
Fails with this document in the search results: curl -k -u admin -XPOST "https://localhost:9200/logstash-2024.03.07/_bulk" -H 'Content-Type: application/json' -d '{"create": {"_index":"logstash-2024.03.07"}} {"@timestamp":"2024-03-08T10:14:00+11:00","message":"2024-03-08T10:14:00+11:00,7327474782641898010,","severity":"info","facility":"user","hostip":"127.0.0.1","host":"localhost"} '
Works Ok with this document: curl -k -u admin -XPOST "https://localhost:9200/logstash-2024.03.07/_bulk" -H 'Content-Type: application/json' -d '{"create": {"_index":"logstash-2024.03.07"}} {"@timestamp":"2024-03-08T10:12:00+11:00","message":"2024-03-08T10:12:00+11:00,7327474782641898010","severity":"info","facility":"user","hostip":"127.0.0.1","host":"localhost"} ' Search error does not occur when the long number 7327474782641898010 is removed, or the commas on either side are removed. Problem did not occur with v2.11.1. Current workaround is using fluentd to remove commas from this logging source before sending to Opensearch.
OpenSearch Version v.2.12.0
Dashboards Version v.2.12.0
Host/Environment (please complete the following information): Ubuntu 22.04.4 Chrome or Edge (current)