Pipeline does not work anymore after upgrade to 7.1.3 from 7.0

Graylog Central (peer support)
1

Hello,

a complex pipeline with 4 stages and 5 rules does not work like before in Graylog 7.0.8.

In stage 4 a rule is applied to a newly created field (created in stage 2, there is no stage 3). The rule is applied only if the field exists.

In 7.0.8 this was working. Now the rule behaves, as it hte filed would not exist. But the field exists with the expected value.

Was there change in the pipeline or rule logic?

Thanks for your help in advance.

Regards,

Dietmar

2

Hey @schurd,

Would you be willing to share the rule to help narrow down what change may have caused this?

3

please share your rule and the (redacted) message you are parsing

4

Hello patrickman,

the broke rule was this:

rule "extract_direct_url_params"
when
has_field("durl") && starts_with(to_string($message.durl),"direct_url=")
then
let res3 = to_string(split("=", to_string($message.durl), '1')[1]);
let res4 = grok("%{URIPROTO:protokoll}://%{URIHOST:saphost}%{URIPATH:sappfad}", res3);
set_field("saphost", res4["saphost"]);
set_field("sappfad", res4["sappfad"]);
let res5 = to_string(split("/", to_string(res4["sappfad"]), '1')[5]);
set_field("reqart", res5);
end

The repaired rule is this:

rule "extract_direct_url_params"
when
has_field("durl") && starts_with(to_string($message.durl),"direct_url=")
then
let res3 = to_string(split("=", to_string($message.durl))[1]);
let res4 = grok("%{URIPROTO:protokoll}://%{URIHOST:saphost}%{URIPATH:sappfad}", res3);
set_field("saphost", res4["saphost"]);
set_field("sappfad", res4["sappfad"]);
let res5 = to_string(split("/", to_string(res4["sappfad"]))[5]);
set_field("reqart", res5);
end

The line after then was the problem:

let res3 = to_string(split("=", to_string($message.durl), '1')[1]);

I worder why this worked before.

Regards,

Dietmar

5

There was a long-standing bug in the parser which caused char literals to be silently ignored. This was fixed in 7.1.0.

Now we parse them correctly, so the limit argument has a value (instead of the default 0).