Issues with processing wrong input by logstash-filter-oui

[okazymyrov (Oleksandr Kazymyrov)]

Hello,

I get an input from a 3rd-party program. The input data might be corrupted, for example:

1C:1D:86:41:3C:80
24:DE:C6:56:17-07-03 07:49:42
24:DE:C6:56:CB:C0

As a result, logstash crashes because of logstash-filter-oui-3.0.1:

[2017 - 07 - 04T08: 38: 01, 587][ERROR][logstash.pipeline]Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.{
"exception" => "undefined method strip' for nil:NilClass", "backtrace" => ["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in to_i'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in find'", "/usr/share/logstash/vendor/jruby/lib/ruby/1.9/monitor.rb:211:in mon_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in find'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.1-java/lib/logstash/filters/oui.rb:33:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:in multi_filter'", "(eval):3528:in initialize'", "org/jruby/RubyArray.java:1613:in each'", "(eval):3520:in initialize'", "org/jruby/RubyProc.java:281:in call'", "(eval):843:in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in filter_batch'", "org/jruby/RubyProc.java:281:in call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in each'", "org/jruby/RubyHash.java:1342:in each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in start_workers'"]
}

[2017 - 07 - 04T08: 38: 01, 720][FATAL][logstash.runner]An unexpected error occurred!{
: error => # < NoMethodError: undefined method strip' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in to_i '", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in find' ", " / usr / share / logstash / vendor / jruby / lib / ruby / 1.9 / monitor.rb: 211: in mon_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in find '", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.1-java/lib/logstash/filters/oui.rb:33:infilter' ", " / usr / share / logstash / logstash - core / lib / logstash / filters / base.rb: 145: in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter '", "org/jruby/RubyArray.java:1613:in each' ", " / usr / share / logstash / logstash - core / lib / logstash / filters / base.rb: 161: in multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:in multi_filter '", "(eval):3528:ininitialize' ", " org / jruby / RubyArray.java: 1613: in each'", "(eval):3520:in initialize '", "org/jruby/RubyProc.java:281:in call' ", "(eval): 843: in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in filter_batch '", "org/jruby/RubyProc.java:281:incall' ", " / usr / share / logstash / logstash - core / lib / logstash / util / wrapped_synchronous_queue.rb: 224: in each'", "org/jruby/RubyHash.java:1342:in each '", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each' ", " / usr / share / logstash / logstash - core / lib / logstash / pipeline.rb: 369: in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in worker_loop '", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:instart_workers' "]}
├

I assume that the issue must be handled by the plugin instead of generating the error.

Kind regards,
Oleksandr

[magnusbaeck (Magnus Bäck)]

Perhaps you can use a conditional to avoid sending events through the oui filter if it's corrupted? Hard to be specific without knowing what your configuration looks like.

If there isn't already an GitHub issue filed for the oui plugin, please file one.

[okazymyrov (Oleksandr Kazymyrov)]

Regex works fine, but it is an additional check for every event. I have reported the issue (with the config file triggering the error) on GitHub.