Graylog2 / Graylog2/graylog2-server
Using $message in pipeline rule source code editor triggers NullPointerException during pipeline metadata analysis
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
Using the build-in `$message` variable in a pipeline rule should not generate any server warnings or exceptions. The rule should be parsed and analyzed successfully by the pipeline metadata analyzer.
## Current Behavior
When using $message variable in a pipeline rule source editor :
```
rule "test"
when
true
then
let test = $message;
end
```
Graylog logs the following warning :
```
java.lang.NullPointerException: Cannot invoke "org.graylog.plugins.pipelineprocessor.ast.expressions.Expression.nodeType()" because "expr" is null
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walkExpression(RuleAstWalker.java:75)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.lambda$visitChildren$1(RuleAstWalker.java:248)
at java.base/java.util.Collections$SingletonSet.forEach(Collections.java:5126)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.visitChildren(RuleAstWalker.java:248)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walkExpression(RuleAstWalker.java:164)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.lambda$walkStatements$2(RuleAstWalker.java:263)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walkStatements(RuleAstWalker.java:252)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walk(RuleAstWalker.java:65)
at org.graylog.plugins.pipelineprocessor.processors.PipelineAnalyzer.analyzeRule(PipelineAnalyzer.java:159)
at org.graylog.plugins.pipelineprocessor.processors.PipelineAnalyzer.lambda$analyzePipelines$0(PipelineAnalyzer.java:121)
at java.base/java.lang.Iterable.forEach(Iterable.java:75)
at org.graylog.plugins.pipelineprocessor.processors.PipelineAnalyzer.analyzePipelines(PipelineAnalyzer.java:99)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdater.handleUpdates(PipelineMetadataUpdater.java:123)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdater.handleRuleChanges(PipelineMetadataUpdater.java:96)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdateJob.execute(PipelineMetadataUpdateJob.java:85)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdateJob.execute(PipelineMetadataUpdateJob.java:53)
at org.graylog.scheduler.system.SystemJob.execute(SystemJob.java:46)
at org.graylog.scheduler.JobExecutionEngine.executeJob(JobExecutionEngine.java:299)
at org.graylog.scheduler.JobExecutionEngine.lambda$handleTrigger$4(JobExecutionEngine.java:272)
at com.codahale.metrics.Timer.time(Timer.java:151)
at org.graylog.scheduler.JobExecutionEngine.handleTrigger(JobExecutionEngine.java:272)
at org.graylog.scheduler.JobExecutionEngine.handleTriggerWithConcurrencyLimit(JobExecutionEngine.java:244)
at org.graylog.scheduler.JobExecutionEngine.lambda$execute$2(JobExecutionEngine.java:209)
at org.graylog.scheduler.worker.JobWorkerPool.lambda$execute$0(JobWorkerPool.java:115)
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:259)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
at java.base/java.lang.Thread.run(Thread.java:1583)
```
During debugging, MessageRefExpression.children() returns a collection containing a single null element (Collections.singleton(null)), wich is then passed to walkExpression(), causing the NullPointerException
## Steps to Reproduce (for bugs)
1. Create a Stream "testStream"
2. Create a pipeline "testPipeline" assigned to the "testStream"
3. Create / update a pipeline rule asssigned to "testPipeline" in source code editor containing $message
4. Check log server for the see java.lang.NullPointerException
## Context
The issue does not prevent editing the rule, but it cause the server to emit warnings every time the pipeline metadata analyzer parse the rule.
The analyzer should gracefully handle MessageRefExpression without attempting to visit a null child.
Debug :
- RuleAstWalker line 164 => expr.fieldExpr is null
- RuleAstWalker line 248 => visitChildren request expr.children()
- MessageRefExpression line 75 => children() return Collections.singleton(fieldExpr)
- RuleAstWalker line 248 => call walkExpression(listener, null)
- RuleAstWalker line 75 => expr.nodeType() fail
## Your Environment
* Graylog Version: 7.1.3
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?
Contributor guide
Research direction
Start with MessageRefExpression.children() and RuleAstWalker.visitChildren()/walkExpression(), using the stack trace and debug notes to follow how the null field expression is handled. Reproduce the rule containing `let test = $message;` and verify that pipeline metadata analysis completes without a NullPointerException or warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100