Graylog2 / Graylog2/graylog2-server

Index is incorrectly included in the search target when it contains a document with timestamp "1970-01-01 00:00:00.000"

Open
#6,015 3 comments 0 reactions 0 assignees View on GitHub
#L bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I'll try to write this #6014 in a more simple and explicit way to you.

Index is **INCORRECTLY** included in the search target when it contains a document with timestamp "1970-01-01 00:00:00.000"

## Expected Behavior
Indices should be included according to their timeranges

## Current Behavior
Index is **INCORRECTLY** included in the search target when it contains a document with timestamp "1970-01-01 00:00:00.000"

## Steps to Reproduce (for bugs)
1. Select an index which you would like to use to trigger this bug (I chose index named beats_90days_2 in my test environment).
2. Search for logs that are **OUTSIDE** that indices time range (I'm using last 5 minutes, and to be clear I'm are talking about 16th of June 2019 which is **NOT** in the 1970s and it is **NOT** "11 days ago")
3. Indices are targeted **CORRECTLY**, beats_90days_2 is **NOT** in the target indices list
4. Add a document using timestamp "1970-01-01 00:00:00.000" to selected index (code snippet below)
5. Recalculate selected index's timerange
6. Search for logs that are **OUTSIDE** that indices time range
7. Indices are targeted **INCORRECTLY**, beats_90days_2 **IS** in the target indices list

![Screen Shot 2019-06-16 at 19 31 20](https://user-images.githubusercontent.com/24830359/59566976-dc1a6e00-906f-11e9-8c6b-af7128c3b9dc.png)

![Screen Shot 2019-06-16 at 19 33 07](https://user-images.githubusercontent.com/24830359/59566989-108e2a00-9070-11e9-91ba-927a0f6a0b73.png)

![Screen Shot 2019-06-16 at 19 35 08](https://user-images.githubusercontent.com/24830359/59566991-1c79ec00-9070-11e9-8383-ba03cce3b6aa.png)

```
curl -X POST "localhost:9200/beats_90days_2/message/" -H 'Content-Type: application/json' -d'
{
"timestamp" : "1970-01-01 00:00:00.000",
"message" : "triggering a bug"
}'
```

![Screen Shot 2019-06-16 at 19 35 20](https://user-images.githubusercontent.com/24830359/59567000-33204300-9070-11e9-9e18-977104c11b9a.png)

![Screen Shot 2019-06-16 at 19 52 40](https://user-images.githubusercontent.com/24830359/59567018-5fd45a80-9070-11e9-8604-dfe24c5a1eb9.png)

![Screen Shot 2019-06-16 at 19 35 29](https://user-images.githubusercontent.com/24830359/59567019-64990e80-9070-11e9-94e3-b3546bfc162b.png)

## Context
Because of this issue, a misinterpreted timestamp in a single document caused an index to be included in **EVERY** search. That index had incorrect datatype. And because of that incorrect datatype the Field statistics functions were broken.

## Your Environment

* Graylog Version: 3.0.1
* Elasticsearch Version: 6.7.2
* MongoDB Version: 4.0.7
* Operating System: CentOS 7
* Browser version: Safari

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.