Issues with processing wrong input by logstash-filter-oui

Elastic Stack Logstash
1

Hello,

I get an input from a 3rd-party program. The input data might be corrupted, for example:

1C:1D:86:41:3C:80
24:DE:C6:56:17-07-03 07:49:42
24:DE:C6:56:CB:C0

As a result, logstash crashes because of logstash-filter-oui-3.0.1:

[2017 - 07 - 04T08: 38: 01, 587][ERROR][logstash.pipeline]Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.{
"exception" => "undefined method strip' for nil:NilClass", "backtrace" => ["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in to_i'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in find'", "/usr/share/logstash/vendor/jruby/lib/ruby/1.9/monitor.rb:211:in mon_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in find'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.1-java/lib/logstash/filters/oui.rb:33:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:in multi_filter'", "(eval):3528:in initialize'", "org/jruby/RubyArray.java:1613:in each'", "(eval):3520:in initialize'", "org/jruby/RubyProc.java:281:in call'", "(eval):843:in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in filter_batch'", "org/jruby/RubyProc.java:281:in call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in each'", "org/jruby/RubyHash.java:1342:in each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in start_workers'"]
}

[2017 - 07 - 04T08: 38: 01, 720][FATAL][logstash.runner]An unexpected error occurred!{
: error => # < NoMethodError: undefined method strip' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in to_i '", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in find' ", " / usr / share / logstash / vendor / jruby / lib / ruby / 1.9 / monitor.rb: 211: in mon_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in find '", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.1-java/lib/logstash/filters/oui.rb:33:infilter' ", " / usr / share / logstash / logstash - core / lib / logstash / filters / base.rb: 145: in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter '", "org/jruby/RubyArray.java:1613:in each' ", " / usr / share / logstash / logstash - core / lib / logstash / filters / base.rb: 161: in multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:in multi_filter '", "(eval):3528:ininitialize' ", " org / jruby / RubyArray.java: 1613: in each'", "(eval):3520:in initialize '", "org/jruby/RubyProc.java:281:in call' ", "(eval): 843: in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in filter_batch '", "org/jruby/RubyProc.java:281:incall' ", " / usr / share / logstash / logstash - core / lib / logstash / util / wrapped_synchronous_queue.rb: 224: in each'", "org/jruby/RubyHash.java:1342:in each '", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each' ", " / usr / share / logstash / logstash - core / lib / logstash / pipeline.rb: 369: in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in worker_loop '", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:instart_workers' "]}
├

I assume that the issue must be handled by the plugin instead of generating the error.

Kind regards,
Oleksandr

2

Perhaps you can use a conditional to avoid sending events through the oui filter if it's corrupted? Hard to be specific without knowing what your configuration looks like.

If there isn't already an GitHub issue filed for the oui plugin, please file one.

3

Regex works fine, but it is an additional check for every event. I have reported the issue (with the config file triggering the error) on GitHub.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.