You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Dissect ingest processor cannot parse empty value with brackets like [], {}, or () correctly, when there exists an empty value with brackets in the text incidentally, the dissect processor throws exception Unable to find match for dissect pattern....
Ingest some documents and using the above pipeline:
normal case:
POST test1/_doc?pipeline=test
{
"message":"[2023-04-13T15:09:03,947][INFO][o.o.n.Node]"
}
abnormal case, the field message contains an empty value with brackets:
POST test1/_doc?pipeline=test
{
"message":"[2023-04-13T15:09:03,947][INFO][]"
}
you can see the error below:
{
"error": {
"root_cause": [
{
"type": "find_match",
"reason": "Unable to find match for dissect pattern: [%{@timestamp}][%{logLevel}][%{class}] against source: [2023-04-13T15:09:03,947][INFO][]"
}
],
"type": "find_match",
"reason": "Unable to find match for dissect pattern: [%{@timestamp}][%{logLevel}][%{class}] against source: [2023-04-13T15:09:03,947][INFO][]"
},
"status": 500
}
Expected behavior
The dissect ingest processor can handle the text containing empty value with brackets gracefully, assign the value to empty string for the matched field.
Screenshots
Host/Environment (please complete the following information):
OS: [Mac OS]
Version [OpenSearch 2.6.0]
The text was updated successfully, but these errors were encountered:
Describe the bug
Dissect ingest processor cannot parse empty value with brackets like [], {}, or () correctly, when there exists an empty value with brackets in the text incidentally, the dissect processor throws exception
Unable to find match for dissect pattern...
.To Reproduce
Steps to reproduce the behavior:
normal case:
abnormal case, the field
message
contains an empty value with brackets:you can see the error below:
Expected behavior
The dissect ingest processor can handle the text containing empty value with brackets gracefully, assign the value to empty string for the matched field.
Screenshots
Host/Environment (please complete the following information):
The text was updated successfully, but these errors were encountered: