Fail to unpack the dns configuration: requires duration < 1 accessing 'processors.0.dns.min_ttl'

Elastic Stack Beats
#1

Hi.

Trying Packetbeat 7.x branch with enabled DNS processor and default config fails with

fail to unpack the dns configuration: requires duration < 1 accessing 'processors.0.dns.min_ttl'

Steps to reproduce:

  1. Config file:
processors:
  - dns: ~
  1. Run config test:
./packetbeat test config --strict.perms=false -c packetbeat.yml

Dirty workaround is to remove "validate: min=1" from https://github.com/elastic/beats/blob/de26878df4a41bca46a10aa061fa2e8065f75abb/libbeat/processors/dns/config.go#L92.

It seems like some problem when parsing yaml into nested structures, see https://github.com/elastic/beats/blob/de26878df4a41bca46a10aa061fa2e8065f75abb/libbeat/processors/dns/config.go#L32

#2

Hi @dddpaul, welcome to the Elastic community forums!

I believe you've found a bug — thanks for reporting it! I've put up a candidate bugfix here: https://github.com/elastic/beats/pull/21085.

Thanks,

Shaunak

#3

Hi.

The problem is not the absense of default value but incorrect parsing into nested structure.
For example, given configuration:

processors:
  - dns:
      type: reverse
      success_cache:
        min_ttl: 2000m

Results with default SuccessCache MinTTL (1m):

DEBUG	[processor.dns]	dns/dns.go:67	DNS processor config: {CacheConfig:{SuccessCache:{TTL:0s MinTTL:1m0s InitialCapacity:1000 MaxCapacity:10000} FailureCache:{TTL:1m0s MinTTL:1m0s InitialCapacity:1000 MaxCapacity:10000}} Nameservers:[] Timeout:500ms Type:reverse Action:append TagOnFailure:[] Fields:null Transport:udp reverseFlat:map[]}	{"instance_id": 1}

The point is that this piece of code (see https://github.com/elastic/beats/blob/bf3eace181c6755a560ede1116bfc26fff0c954f/libbeat/processors/dns/config.go#L31):

// Config defines the configuration options for the DNS processor.
type Config struct {
	CacheConfig
	Nameservers  []string      `config:"nameservers"`
	...
}

// CacheConfig defines the success and failure caching parameters.
type CacheConfig struct {
	SuccessCache CacheSettings `config:"success_cache"`
	FailureCache CacheSettings `config:"failure_cache"`
}

should work like:

// Config defines the configuration options for the DNS processor.
type Config struct {
	SuccessCache CacheSettings `config:"success_cache"`
	FailureCache CacheSettings `config:"failure_cache"`
	Nameservers  []string      `config:"nameservers"`
	...
}

But it doesn't.

#4

Oh, sorry, I misunderstood! Unlike yesterday I don't have time today to immediately look into a fix so would you mind reporting this bug on GitHub please: https://github.com/elastic/beats/issues/new?template=bug-report.md?

Thanks,

Shaunak

#5

Done - https://github.com/elastic/beats/issues/21103