Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Statistic and Chart error : Adding time zone offset caused overflow #1257

Closed
lafeuil opened this issue Jun 19, 2015 · 2 comments
Closed

Statistic and Chart error : Adding time zone offset caused overflow #1257

lafeuil opened this issue Jun 19, 2015 · 2 comments
Assignees
Labels
bug
Milestone

Comments

@lafeuil
Copy link

@lafeuil lafeuil commented Jun 19, 2015

I have an exception when I want to create statitics or chart from a field in the search.
I obtain the following request and reponse when I click on "Statistics"
Request

GET /a/search/fieldstats?q=&field=rip&rangetype=absolute&from=2015-05-05T15%3A05%3A35.890Z&to=2015-05-05T15%3A06%3A00.000Z HTTP/1.1
Host: graylog:9000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-gb,en;q=0.8,de;q=0.5,fr;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: http://graylog:9000/search?rangetype=absolute&fields=message%2Csource&width=1663&from=2015-05-05T15%3A05%3A35.890Z&to=2015-05-05T15%3A06%3A00.000Z&q=
Cookie: PLAY_SESSION=d21777087737e3634f039088f8b5c4e77f3245fe-disconnected_orig_uri=%2Fstartpage&sessionid=2a6e43ce5efbb4ac60ff72cf19eac530843bd28f1e6a6b561c6ff0404029c549d3fc7cc48924c7ca100338690889480a
Connection: keep-alive

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Content-Length: 119

{"sum_of_squares":0.0,"min":Infinity,"max":-Infinity,"variance":NaN,"mean":NaN,"count":0,"std_deviation":NaN,"sum":0.0}

I obtain the following request and reponse when I click on "Generate chart" :
Request

GET /a/search/fieldhistogram?rangetype=absolute&q=&field=rip&interval=hour&valueType=mean&streamId=&from=2015-05-05T00%3A00%3A00.000Z&to=2015-05-06T00%3A00%3A00.000Z HTTP/1.1
Host: graylog:9000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: */*
Accept-Language: en-gb,en;q=0.8,de;q=0.5,fr;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: http://graylog:9000/search?rangetype=absolute&fields=message%2Csource&width=1680&from=2015-05-05T00%3A00%3A00.000Z&to=2015-05-06T00%3A00%3A00.000Z&q=
Cookie: PLAY_SESSION=d21777087737e3634f039088f8b5c4e77f3245fe-disconnected_orig_uri=%2Fstartpage&sessionid=2a6e43ce5efbb4ac60ff72cf19eac530843bd28f1e6a6b561c6ff0404029c549d3fc7cc48924c7ca100338690889480a
Connection: keep-alive

Response

HTTP/1.1 500 Internal Server Error
Cache-Control: no-cache
Content-Type: text/plain; charset=utf-8
Content-Length: 372

api exception org.graylog2.restclient.lib.APIException: API call failed GET http://@127.0.0.1:12900/search/universal/absolute/fieldhistogram?filter=*&field=rip&query=*&interval=hour&from=2015-05-05T00:00:00.000Z&to=2015-05-06T00:00:00.000Z&range_type=absolute returned 500 Internal Server Error body: {"type":"ApiError","message":"Adding time zone offset caused overflow"}

In the log, I found this stacktrace but I don't understand where is the problem (in my data or in graylog) :

2015-06-19 17:07:47,365 ERROR: org.graylog2.shared.rest.exceptionmappers.AnyExceptionClassMapper - Unhandled exception in REST resource
java.lang.ArithmeticException: Adding time zone offset caused overflow
        at org.joda.time.DateTimeZone.convertUTCToLocal(DateTimeZone.java:929)
        at org.joda.time.chrono.ZonedChronology$ZonedDateTimeField.get(ZonedChronology.java:422)
        at org.joda.time.base.BaseDateTime.<init>(BaseDateTime.java:129)
        at org.joda.time.base.BaseDateTime.<init>(BaseDateTime.java:97)
        at org.joda.time.MutableDateTime.<init>(MutableDateTime.java:209)
        at org.graylog2.indexer.results.FieldHistogramResult.getResults(FieldHistogramResult.java:77)
        at org.graylog2.rest.resources.search.SearchResource.buildHistogramResult(SearchResource.java:182)
        at org.graylog2.rest.resources.search.AbsoluteSearchResource.fieldHistogramAbsolute(AbsoluteSearchResource.java:301)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:497)
        at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:164)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:181)
        at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:203)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:101)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102)
        at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:305)
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271)
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:267)
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317)
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:288)
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1110)
        at org.graylog2.jersey.container.netty.NettyContainer.messageReceived(NettyContainer.java:356)
        at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
        at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
        at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
        at org.jboss.netty.handler.execution.ChannelUpstreamEventRunnable.doRun(ChannelUpstreamEventRunnable.java:43)
        at org.jboss.netty.handler.execution.ChannelEventRunnable.run(ChannelEventRunnable.java:67)
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176)
        at org.jboss.netty.handler.execution.MemoryAwareThreadPoolExecutor$MemoryAwareRunnable.run(MemoryAwareThreadPoolExecutor.java:622)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

Is it a bug in graylog or does it become from my data ?
Is it the same bug for "Statistics" and "Chart" ?

@joschi
Copy link
Contributor

@joschi joschi commented Jun 23, 2015

Thanks for reporting this issue! It looks like this is a bug in Graylog. Even malicious data should never trigger such an exception.

Could you please provide some messages which cause this error? And which timezone is configured on the system running the Graylog server?

@lafeuil
Copy link
Author

@lafeuil lafeuil commented Jun 24, 2015

I agree with you about even malicious data should never trigger such an exception.

I have a TCP Input with two extractors. The first extracts data with grok pattern and extract the field localtime. For example, localtime : "05/May/2015:07:00:00 +0200".
The second extractor is a Timestamp Extractor that copies the field localtime and convert string to date type with the pattern "dd/MMM/yyyy:HH:mm:ss Z".

I think this is correct because the message have a correct timestamp when I search it :
"localtime" : "05/May/2015:07:00:00 +0200"
"timestamp" : "2015-05-05 05:00:00.000"

The timezone on the system running the graylog server is :
$ date +"%Z %z"
CEST +0200

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants