Graylog2 / Graylog2/graylog2-server
Show Plugin/code install state across cluster
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Recently spent too long troubleshooting why a pipeline rule parser only seemed to work on some messages through the pipeline. Comparing properly parsed messages and nonparsed messages there was no outliers, the messages should have been parsed. Turns out, the parser plugin(csv) wasn't loaded on *some* graylog nodes. The Editor doesn't complain as long as the plugin is on the node you're working from, but seems to silently fail on other nodes.
## Expected Behavior
There should be a sanity check on the configuration or overview pages which checks all plugin distribution state across every node(or configuration state in general). When you have 30+ graylog nodes, missing a plugin on a single node can be problematic to detect.
## Current Behavior
The node with the missing pipeline parser apparently silently sends the message through unparsed. When reviewing the rule in the editor, unless you're on the node with the missing plugin there is no syntax or otherwise an indication there is a problem.
## Possible Solution
Have an option to run a parser check across all nodes to check for syntax errors. This should probably be on one of the existing Overview or Configuration views.
## Steps to Reproduce (for bugs)
1. Manually install pipeline rule parser plugin via package/source on a node. (not on all nodes)
2. Use that new plugin on that node to create a parse rule/function.
3. Run messages through pipeline, note not all of them are parsed.
4. Switch to one of the nodes without the plugin- in the editor a syntax err will show indicating it does not recognize the function in the pipeline rule.
## Context
Spent too long troubleshooting why some messages were not being properly parsed.
* Graylog Version: 3.0.1
Contributor guide
Assessment
This issue has not been assessed yet.