Skip to content

NameError when using fallback timestamp logic #16

@ericdahl

Description

@ericdahl

I'm observing that some events are not processed correctly due to a log statement issue.

Given an event like:

{
  "timestamp": "10/Aug/2021:22:48:47 +0000",
  "access": "GET / HTTP/1.1 200",
  "type": "access"
}

(that is, not using the "normal timestamp processing" but instead the secondary/backup parsing)

The result is an error such as:

2021-08-10 22:48:52 +0000 [warn]: #0 dump an error event: error_class=NameError error="undefined local variable or method `field' for #<Fluent::Plugin::ElasticsearchTimestampCheckFilter:0x00007f1780cc19a8>\nDid you mean?  yield" location="/usr/local/bundle/gems/fluent-plugin-elasticsearch-timestamp-check-0.3.0/lib/fluent/plugin/filter_elasticsearch_timestamp_check.rb:62:in `rescue in block in filter'" tag="docker.var.lib.docker.containers.83e55d29166ac414218614dda4e51e0409d9844e0629d50128edbb5e3bc6c9d7.83e55d29166ac414218614dda4e51e0409d9844e0629d50128edbb5e3bc6c9d7-json.log" time=2021-08-10 

22:48:52.731255982 +0000 record={"timestamp"=>"10/Aug/2021:22:48:47 +0000", "access"=>"GET / HTTP/1.1 200"}

It seems like the issue is that field is out of scope at this line (but I don't know Ruby..):

$log.debug("#{field} (#{timestamp}) failed to parse, trying next")

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions