Graylog2 / Graylog2/graylog2-server

Content Packs - creating a pack with an entity that references a deleted stream causes install to fail

Open
#23,968 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

From customer issue: https://github.com/Graylog2/support/issues/346

## Expected Behavior

Should not be able to create a content pack that is guaranteed to fail.

## Current Behavior

If I have a saved search (or dashboard/pipleline etc.) that is scoped to a stream, then delete the stream, there is still a dangling reference to that stream on the saved search (known and expected behavior as far as I know).

If I then create a content pack including that saved search I am able to, but on installation the pack fails to be installed with error:
```
2025-10-02T10:52:39.815-04:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
org.graylog2.contentpacks.exceptions.ContentPackException: Failed to install content pack
at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:213) ~[graylog.jar:?]
at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:141) ~[graylog.jar:?]
at org.graylog2.rest.resources.system.contentpacks.ContentPackResource.installContentPack(ContentPackResource.java:299) ~[graylog.jar:?]
at jdk.internal.reflect.GeneratedMethodAccessor2287.invoke(Unknown Source) ~[?:?]
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
at java.base/java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400) ~[graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:274) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266) [graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253) [graylog.jar:?]
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:696) [graylog.jar:?]
at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:367) [graylog.jar:?]
at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:190) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:259) [graylog.jar:?]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.base/java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.contentpacks.exceptions.MissingNativeEntityException: Missing native entity: EntityDescriptor{id=06959148-75b2-4335-9f77-dd536f431043, type=ModelType{name=stream, version=1}}
at org.graylog2.contentpacks.facades.PipelineFacade.connectedStreams(PipelineFacade.java:178) ~[graylog.jar:?]
at org.graylog2.contentpacks.facades.PipelineFacade.decode(PipelineFacade.java:157) ~[graylog.jar:?]
at org.graylog2.contentpacks.facades.PipelineFacade.createNativeEntity(PipelineFacade.java:132) ~[graylog.jar:?]
at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:204) ~[graylog.jar:?]
```

## Possible Solution

Either:
- When creating a content pack, strip streams that no longer exist from entities that reference them
- Throw when creating a content pack with an entity in that state

## Steps to Reproduce (for bugs)

1. Have a saved search scoped to a stream
2. delete the stream
3. create a content pack with the saved search
4. try to install the content pack

## Context

From customer issue: https://github.com/Graylog2/support/issues/346

## Your Environment

* Graylog Version: 6.3 -> 7.0 at least
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

## Checklist
[X] This issue fix need to be backported.
[] Does this issue have **security** implications?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.