Graylog2 / Graylog2/graylog2-server

Using $message in pipeline rule source code editor triggers NullPointerException during pipeline metadata analysis

Open Beginner friendly
#26,623 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
Using the build-in `$message` variable in a pipeline rule should not generate any server warnings or exceptions. The rule should be parsed and analyzed successfully by the pipeline metadata analyzer.

## Current Behavior
When using $message variable in a pipeline rule source editor :
```
rule "test"
when
true
then
let test = $message;
end
```

Graylog logs the following warning :
```
java.lang.NullPointerException: Cannot invoke "org.graylog.plugins.pipelineprocessor.ast.expressions.Expression.nodeType()" because "expr" is null
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walkExpression(RuleAstWalker.java:75)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.lambda$visitChildren$1(RuleAstWalker.java:248)
at java.base/java.util.Collections$SingletonSet.forEach(Collections.java:5126)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.visitChildren(RuleAstWalker.java:248)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walkExpression(RuleAstWalker.java:164)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.lambda$walkStatements$2(RuleAstWalker.java:263)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walkStatements(RuleAstWalker.java:252)
at org.graylog.plugins.pipelineprocessor.ast.RuleAstWalker.walk(RuleAstWalker.java:65)
at org.graylog.plugins.pipelineprocessor.processors.PipelineAnalyzer.analyzeRule(PipelineAnalyzer.java:159)
at org.graylog.plugins.pipelineprocessor.processors.PipelineAnalyzer.lambda$analyzePipelines$0(PipelineAnalyzer.java:121)
at java.base/java.lang.Iterable.forEach(Iterable.java:75)
at org.graylog.plugins.pipelineprocessor.processors.PipelineAnalyzer.analyzePipelines(PipelineAnalyzer.java:99)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdater.handleUpdates(PipelineMetadataUpdater.java:123)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdater.handleRuleChanges(PipelineMetadataUpdater.java:96)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdateJob.execute(PipelineMetadataUpdateJob.java:85)
at org.graylog.plugins.pipelineprocessor.processors.PipelineMetadataUpdateJob.execute(PipelineMetadataUpdateJob.java:53)
at org.graylog.scheduler.system.SystemJob.execute(SystemJob.java:46)
at org.graylog.scheduler.JobExecutionEngine.executeJob(JobExecutionEngine.java:299)
at org.graylog.scheduler.JobExecutionEngine.lambda$handleTrigger$4(JobExecutionEngine.java:272)
at com.codahale.metrics.Timer.time(Timer.java:151)
at org.graylog.scheduler.JobExecutionEngine.handleTrigger(JobExecutionEngine.java:272)
at org.graylog.scheduler.JobExecutionEngine.handleTriggerWithConcurrencyLimit(JobExecutionEngine.java:244)
at org.graylog.scheduler.JobExecutionEngine.lambda$execute$2(JobExecutionEngine.java:209)
at org.graylog.scheduler.worker.JobWorkerPool.lambda$execute$0(JobWorkerPool.java:115)
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:259)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
at java.base/java.lang.Thread.run(Thread.java:1583)
```

During debugging, MessageRefExpression.children() returns a collection containing a single null element (Collections.singleton(null)), wich is then passed to walkExpression(), causing the NullPointerException

## Steps to Reproduce (for bugs)
1. Create a Stream "testStream"
2. Create a pipeline "testPipeline" assigned to the "testStream"
3. Create / update a pipeline rule asssigned to "testPipeline" in source code editor containing $message
4. Check log server for the see java.lang.NullPointerException

## Context
The issue does not prevent editing the rule, but it cause the server to emit warnings every time the pipeline metadata analyzer parse the rule.
The analyzer should gracefully handle MessageRefExpression without attempting to visit a null child.

Debug :
- RuleAstWalker line 164 => expr.fieldExpr is null
- RuleAstWalker line 248 => visitChildren request expr.children()
- MessageRefExpression line 75 => children() return Collections.singleton(fieldExpr)
- RuleAstWalker line 248 => call walkExpression(listener, null)
- RuleAstWalker line 75 => expr.nodeType() fail

## Your Environment

* Graylog Version: 7.1.3
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?

Contributor guide

Open the contributing guide

Research direction

Start with MessageRefExpression.children() and RuleAstWalker.visitChildren()/walkExpression(), using the stack trace and debug notes to follow how the null field expression is handled. Reproduce the rule containing `let test = $message;` and verify that pipeline metadata analysis completes without a NullPointerException or warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.