Skip to content

Commit 554eb4f

Browse files
ES|QL: better validation of GROK patterns (#112200)
Catch exceptions when building GROK with a wrong pattern, and emit a client exception with a meaningful error message. Fixes #112111
1 parent 8431c36 commit 554eb4f

File tree

3 files changed

+18
-1
lines changed

3 files changed

+18
-1
lines changed

docs/changelog/112200.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pr: 112200
2+
summary: "ES|QL: better validation of GROK patterns"
3+
area: ES|QL
4+
type: bug
5+
issues:
6+
- 112111

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/parser/LogicalPlanBuilder.java

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
import org.elasticsearch.xpack.esql.plan.logical.meta.MetaFunctions;
5858
import org.elasticsearch.xpack.esql.plan.logical.show.ShowInfo;
5959
import org.elasticsearch.xpack.esql.plugin.EsqlPlugin;
60+
import org.joni.exception.SyntaxException;
6061

6162
import java.util.ArrayList;
6263
import java.util.Arrays;
@@ -153,7 +154,12 @@ public PlanFactory visitGrokCommand(EsqlBaseParser.GrokCommandContext ctx) {
153154
return p -> {
154155
Source source = source(ctx);
155156
String pattern = visitString(ctx.string()).fold().toString();
156-
Grok.Parser grokParser = Grok.pattern(source, pattern);
157+
Grok.Parser grokParser;
158+
try {
159+
grokParser = Grok.pattern(source, pattern);
160+
} catch (SyntaxException e) {
161+
throw new ParsingException(source, "Invalid grok pattern [{}]: [{}]", pattern, e.getMessage());
162+
}
157163
validateGrokPattern(source, grokParser, pattern);
158164
Grok result = new Grok(source(ctx), p, expression(ctx.primaryExpression()), grokParser);
159165
return result;

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/parser/StatementParserTests.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -791,6 +791,11 @@ public void testGrokPattern() {
791791
"line 1:22: Invalid GROK pattern [%{NUMBER:foo} %{WORD:foo}]:"
792792
+ " the attribute [foo] is defined multiple times with different types"
793793
);
794+
795+
expectError(
796+
"row a = \"foo\" | GROK a \"(?P<justification>.+)\"",
797+
"line 1:18: Invalid grok pattern [(?P<justification>.+)]: [undefined group option]"
798+
);
794799
}
795800

796801
public void testLikeRLike() {

0 commit comments

Comments
 (0)