Contentpack Bundle Error

hun · October 5, 2017, 11:07am

Hi Community,

I have a contentpack which contains a stream, while I am able to upload the contentpack, I fail to apply it and get the following error:

2017-10-05T12:57:50.855+02:00 ERROR [BundleImporter] Error while creating entities in content pack. Starting rollback.
java.lang.IllegalArgumentException: null
	at org.bson.types.ObjectId.isValid(ObjectId.java:92) ~[graylog.jar:?]
	at org.bson.types.ObjectId.parseHexString(ObjectId.java:549) ~[graylog.jar:?]
	at org.bson.types.ObjectId.<init>(ObjectId.java:240) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleImporter.createStream(BundleImporter.java:486) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleImporter.createStreams(BundleImporter.java:458) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleImporter.runImport(BundleImporter.java:140) [graylog.jar:?]
	at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:112) [graylog.jar:?]
	at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:105) [graylog.jar:?]
	at org.graylog2.rest.resources.system.bundles.BundleResource.applyBundle(BundleResource.java:184) [graylog.jar:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_144]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_144]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_144]
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) [graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_144]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_144]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_144]
2017-10-05T12:57:50.860+02:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
java.lang.IllegalArgumentException: null
	at org.bson.types.ObjectId.isValid(ObjectId.java:92) ~[graylog.jar:?]
	at org.bson.types.ObjectId.parseHexString(ObjectId.java:549) ~[graylog.jar:?]
	at org.bson.types.ObjectId.<init>(ObjectId.java:240) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleImporter.createStream(BundleImporter.java:486) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleImporter.createStreams(BundleImporter.java:458) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleImporter.runImport(BundleImporter.java:140) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:112) ~[graylog.jar:?]
	at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:105) ~[graylog.jar:?]
	at org.graylog2.rest.resources.system.bundles.BundleResource.applyBundle(BundleResource.java:184) ~[graylog.jar:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_144]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_144]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_144]
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) ~[graylog.jar:?]
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) ~[graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
	at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_144]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_144]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_144]

Also here’s the contentpack I mentioned earlier:

{
  "name": "Streams",
  "description": "Adds Streams",
  "category": "Streams",
  "inputs": [],
  "streams": [
    {
      "title": "title",
      "description": "description",
      "matching_type": "AND",
      "stream_rules": [
        {
          "field": "field",
          "type": "EXACT",
          "inverted": false,
          "value": "value",
          "description": ""
        },
        {
          "field": "field",
          "type": "EXACT",
          "inverted": false,
          "value": "",
          "description": ""
        },
        {
          "field": "field",
          "type": "EXACT",
          "inverted": true,
          "value": "value",
          "description": ""
        }
      ]
    }
  ],
  "outputs": [],
  "dashboards": [],
  "grok_patterns": []
}

Cheers,

jochen · October 5, 2017, 11:45am

Did you create that content pack manually or did you modify it after exporting it from Graylog?
Which version of Graylog are you using?

hun · October 5, 2017, 11:50am

I created it according to an exported stream from Graylog as a content pack. I have version 2.2.3. Please find the exported content pack:

{
  "name": "nginx",
  "description": "check",
  "category": "streams",
  "inputs": [],
  "streams": [
    {
      "id": "547b29b6d4c6c10b4f1b934d",
      "title": "nginx",
      "description": "All requests that were logged into the nginx access_log or nginx_error_log",
      "disabled": false,
      "matching_type": "AND",
      "stream_rules": [
        {
          "type": "EXACT",
          "field": "from_nginx",
          "value": "true",
          "inverted": false,
          "description": ""
        },
        {
          "type": "EXACT",
          "field": "from_nginx",
          "value": "true",
          "inverted": false,
          "description": ""
        }
      ],
      "outputs": [],
      "default_stream": false
    }
  ],
  "outputs": [],
  "dashboards": [],
  "grok_patterns": []
}

jochen · October 5, 2017, 12:32pm

You’ve missed the “id” field for streams in your modified copy.

My recommendation is to not modify the exported content packs manually (unless you’re 100% sure what you’re doing).

hun · October 5, 2017, 1:08pm

Thanks a lot! I think I will create them via api and then export them as a content pack!

system · October 19, 2017, 1:08pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to install Content pack Graylog Central (peer support)	5	1483	March 19, 2020
Can’t import content pack from market Graylog Add-ons	3	1949	February 25, 2019
Can't upload content pack Graylog Add-ons	5	1736	December 4, 2018
Unable to import content packs downloaded from marketplace Graylog Add-ons	5	4298	February 21, 2019
GET /api/system/bundles returns "ApiError" with empty message and HTTP code 500 Graylog Central (peer support)	5	464	December 25, 2019

Contentpack Bundle Error

Related topics