elastic / elastic/logstash

Event clone, performs shallow copy, breaking cloned events.

Open
#5,211 7 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

In logstash 2.3.x
- When cloning events, with depth > 2, changes to the cloned event will modify the original event.

In the folowing test, the original event, in message should be unchanged, but after the mutate, applied to the cloned event, the original event, gets modified.

``` ruby
input {
generator {
message => '{"a": {"a" : "v aa"} ,"b": {"a":{"a":"v b_aa","b":"v bab"}}}'
codec => json
count => 1
}
}

filter {
clone {
clones => ["clone"]
}

if [type] == "clone" {
mutate {
rename => {
"[a][a]" => "[c_aa]"
"[b][a][a]" => "[c_ba][a]"
# "[b][a][b]" => "[c_ba][b]"
}
}
}
}

output {
stdout { codec => rubydebug { metadata => true } }
}
```

[b][a][a] gets removed from the original event due to the later mutate in the cloned event.

The issue seems to be identified in the 2.3 code event.rb.

``` ruby
# Create a deep-ish copy of this event.
def clone
copy = {}
@data.each do |k,v|
#TODO(sissel): Recurse if this is a hash/array?
copy[k] = begin v.clone rescue v end
end

self.class.new(copy)
end
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.