Graylog2 / Graylog2/graylog2-server

API returns error when validating pipeline function that contains reference to $message

Open
#5,223 3 comments 0 reactions 0 assignees View on GitHub
#M bug processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When writing a pipeline rule that references the $message object, the API returns an HTTP 500 error, with the contents "`{"type":"ApiError","message":""}`". This issue does not seem to be present when referencing something within $message, such as $message.message, or $message.source.

## Expected Behavior

API should return an HTTP 200 response, or a 400 response with details about the errors with the pipeline rule code.

## Current Behavior

API returns an HTTP 500 error with the contents "`{"type":"ApiError","message":""}`"

## Possible Solution

Make sure the API can handle any reference to $message?

## Steps to Reproduce (for bugs)

1. Open a browser to the "Manage rules" page (`http://your_server/system/pipelines/rules`)
2. Open the browser tool to monitor requests and responses to the API
3. Create a new rule
4. Define a rule that includes a reference to $message
Example:
```
rule "test"
when
true
then
let msg = $message;
end
```

## Context

Developing a new pipeline rule, or editing an existing pipeline rule.
See for a specific rule that needs to use the $message object.

## Your Environment

* Graylog Version: Graylog 2.4.6+ceaa7e4
* Elasticsearch Version: 2.4.6
* MongoDB Version: 2.6.10
* Operating System: Ubuntu
* Browser version: Chrome 69.0.3497.100

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.