Skip to content

[BUG] Dissect ingest processor cannot parse empty value with brackets #7223

@gaobinlong

Description

@gaobinlong

Describe the bug
Dissect ingest processor cannot parse empty value with brackets like [], {}, or () correctly, when there exists an empty value with brackets in the text incidentally, the dissect processor throws exception Unable to find match for dissect pattern....

To Reproduce
Steps to reproduce the behavior:

  1. Create an ingest pipeline:
PUT _ingest/pipeline/test
{
  "processors": [
      {
        "dissect": {
          "field": "message",
          "pattern": "[%{@timestamp}][%{logLevel}][%{class}]"
        }
      }
    ]
}
  1. Ingest some documents and using the above pipeline:

normal case:

POST test1/_doc?pipeline=test
{
  "message":"[2023-04-13T15:09:03,947][INFO][o.o.n.Node]"
}

abnormal case, the field message contains an empty value with brackets:

POST test1/_doc?pipeline=test
{
  "message":"[2023-04-13T15:09:03,947][INFO][]"
}

you can see the error below:

{
  "error": {
    "root_cause": [
      {
        "type": "find_match",
        "reason": "Unable to find match for dissect pattern: [%{@timestamp}][%{logLevel}][%{class}] against source: [2023-04-13T15:09:03,947][INFO][]"
      }
    ],
    "type": "find_match",
    "reason": "Unable to find match for dissect pattern: [%{@timestamp}][%{logLevel}][%{class}] against source: [2023-04-13T15:09:03,947][INFO][]"
  },
  "status": 500
}

Expected behavior
The dissect ingest processor can handle the text containing empty value with brackets gracefully, assign the value to empty string for the matched field.

Screenshots
image

Host/Environment (please complete the following information):

  • OS: [Mac OS]
  • Version [OpenSearch 2.6.0]

Metadata

Metadata

Assignees

Labels

SearchSearch query, autocomplete ...etcSearch:RelevancebugSomething isn't working

Type

No type

Projects

Status

✅ Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions