-
Notifications
You must be signed in to change notification settings - Fork 2.5k
Closed
Labels
SearchSearch query, autocomplete ...etcSearch query, autocomplete ...etcSearch:RelevancebugSomething isn't workingSomething isn't working
Description
Describe the bug
Dissect ingest processor cannot parse empty value with brackets like [], {}, or () correctly, when there exists an empty value with brackets in the text incidentally, the dissect processor throws exception Unable to find match for dissect pattern....
To Reproduce
Steps to reproduce the behavior:
- Create an ingest pipeline:
PUT _ingest/pipeline/test
{
"processors": [
{
"dissect": {
"field": "message",
"pattern": "[%{@timestamp}][%{logLevel}][%{class}]"
}
}
]
}
- Ingest some documents and using the above pipeline:
normal case:
POST test1/_doc?pipeline=test
{
"message":"[2023-04-13T15:09:03,947][INFO][o.o.n.Node]"
}
abnormal case, the field message contains an empty value with brackets:
POST test1/_doc?pipeline=test
{
"message":"[2023-04-13T15:09:03,947][INFO][]"
}
you can see the error below:
{
"error": {
"root_cause": [
{
"type": "find_match",
"reason": "Unable to find match for dissect pattern: [%{@timestamp}][%{logLevel}][%{class}] against source: [2023-04-13T15:09:03,947][INFO][]"
}
],
"type": "find_match",
"reason": "Unable to find match for dissect pattern: [%{@timestamp}][%{logLevel}][%{class}] against source: [2023-04-13T15:09:03,947][INFO][]"
},
"status": 500
}
Expected behavior
The dissect ingest processor can handle the text containing empty value with brackets gracefully, assign the value to empty string for the matched field.
Host/Environment (please complete the following information):
- OS: [Mac OS]
- Version [OpenSearch 2.6.0]
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
SearchSearch query, autocomplete ...etcSearch query, autocomplete ...etcSearch:RelevancebugSomething isn't workingSomething isn't working
Type
Projects
Status
✅ Done
