Graylog2 / Graylog2/graylog2-server

remove_field removes wrong field (dots and underscores are set equal)

Open
#16,047 5 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

pipeline function _remove_field removes field(s) as in 5.0

## Current Behavior

remove_field does not difference between _ and '.' in Field name

## Possible Solution

Something in 5.1 broke this feature

## Steps to Reproduce (for bugs)

1.) Create Pipeline rule

```
set_field("test.duplicate", "test-1");
set_field("test_duplicate", concat(to_string($message.`test.duplicate`),"-2"));
remove_field("test.duplicate");
```

2.) observe that test_duplicate is not present

## Context

Rules which worked fine in 5.0 got broken with update on 5.1 without any processing error or other indicator
## Your Environment

* Graylog Version: 5.1
* Java Version: 17
* OpenSearch Version: 2.7
* MongoDB Version: 5
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.