Should rewrite_tag allow for a static new tag?

[braydonk]

Bug Report

Describe the bug
It appears that using a static pattern for the new tag in rewrite_tag, aka one that does not use any record accesor functionality, will cause fluent bit to rewrite the tag as a blank string.

To Reproduce

• Steps to reproduce the problem:
  The best way to observe the behaviour is to first run Fluent Bit with this config, where you can see it work as expected:

[SERVICE]
    Flush     1
    Log_Level debug

[INPUT]
    NAME   dummy
    Dummy  {"tool": "fluent", "sub": {"s1": {"s2": "bit"}}}
    Tag    a

[FILTER]
    Name          rewrite_tag
    Match         a
    Rule          $tool ^(fluent)$ b.$TAG false 
    Emitter_Name  re_emitted

[OUTPUT]
    Name file
    Match a
    Path choose/a/log/path
    File a.txt

[OUTPUT]
    Name file
    Match b.a
    Path choose/a/log/path
    File b.txt

In this scenario, a.txt is empty, and b.txt contains:

b.a: [1683322738.028321063, {"tool":"fluent","sub":{"s1":{"s2":"bit"}}}]
b.a: [1683322739.028365827, {"tool":"fluent","sub":{"s1":{"s2":"bit"}}}]
b.a: [1683322740.028366062, {"tool":"fluent","sub":{"s1":{"s2":"bit"}}}]
...

Next, run Fluent Bit with this slightly altered config:

[SERVICE]
    Flush     1
    Log_Level debug

[INPUT]
    NAME   dummy
    Dummy  {"tool": "fluent", "sub": {"s1": {"s2": "bit"}}}
    Tag    a

[FILTER]
    Name          rewrite_tag
    Match         a
    Rule          $tool ^(fluent)$ b false
    Emitter_Name  re_emitted

[OUTPUT]
    Name file
    Match a
    Path choose/a/log/path
    File a.txt

[OUTPUT]
    Name file
    Match b
    Path choose/a/log/path
    File b.txt

In this scenario, both b.txt and a.txt are empty. Changing the Rule in rewrite_tag such that we keep the original log, a.txt has the following:

a: [1683323220.028342314, {"tool":"fluent","sub":{"s1":{"s2":"bit"}}}]
a: [1683323221.028380836, {"tool":"fluent","sub":{"s1":{"s2":"bit"}}}]
a: [1683323222.028332510, {"tool":"fluent","sub":{"s1":{"s2":"bit"}}}]
...

Expected behavior
I should be allowed to successfully rewrite a tag to something static without any record accesor functionality.

Your Environment

• Version used: 2.0.12
• Configuration: See reproduction
• Filters and plugins: rewrite_tag

Additional context
I am almost certain the problem is in this function:

fluent-bit/src/flb_record_accessor.c

Line 613 in 5864c41

flb_sds_t flb_ra_translate_check(struct flb_record_accessor *ra,

If the record accesor list is empty, it won't actually process anything, simply returning an "" buf successfully. I tried to hack this by manually setting buf if ra->list was found to be empty. It worked, though it caused a double free somewhere and I don't have time yet to determine what went wrong.

[nokute78]

Static tag is allowed.
However a single character seems not to be allowed. I think it is a bug.

Workaround is following rule (set characters)

    Rule          $tool ^(fluent)$ bb false

[SERVICE]
    Flush     1
    Log_Level debug

[INPUT]
    NAME   dummy
    Dummy  {"tool": "fluent", "sub": {"s1": {"s2": "bit"}}}
    Tag    a

[FILTER]
    Name          rewrite_tag
    Match         a
    Rule          $tool ^(fluent)$ bb false
    Emitter_Name  re_emitted

[OUTPUT]
    Name stdout
    Match a

[OUTPUT]
    Name stdout
    Match b*

[braydonk]

Thank you @nokute78 that's very helpful. I think I found the bug, a calculation in ra_parse_buffer that does not work when the pattern is only 1 character long. I will submit a PR to resolve!

[nokute78]

@braydonk Oops, I sent a patch #7332
Could you check it ?

[braydonk]

No problem, thanks @nokute78! Looks like how I was intending to fix it anyway.

[nokute78]

@braydonk Thank you for reviewing.

[braydonk]

Thanks for fixing this! Backport issue is #7335