New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Statistic and Chart error : Adding time zone offset caused overflow #1257

Closed
lafeuil opened this Issue Jun 19, 2015 · 2 comments

Comments

Projects
None yet
2 participants
@lafeuil

lafeuil commented Jun 19, 2015

I have an exception when I want to create statitics or chart from a field in the search.
I obtain the following request and reponse when I click on "Statistics"
Request

GET /a/search/fieldstats?q=&field=rip&rangetype=absolute&from=2015-05-05T15%3A05%3A35.890Z&to=2015-05-05T15%3A06%3A00.000Z HTTP/1.1
Host: graylog:9000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-gb,en;q=0.8,de;q=0.5,fr;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: http://graylog:9000/search?rangetype=absolute&fields=message%2Csource&width=1663&from=2015-05-05T15%3A05%3A35.890Z&to=2015-05-05T15%3A06%3A00.000Z&q=
Cookie: PLAY_SESSION=d21777087737e3634f039088f8b5c4e77f3245fe-disconnected_orig_uri=%2Fstartpage&sessionid=2a6e43ce5efbb4ac60ff72cf19eac530843bd28f1e6a6b561c6ff0404029c549d3fc7cc48924c7ca100338690889480a
Connection: keep-alive

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Content-Length: 119

{"sum_of_squares":0.0,"min":Infinity,"max":-Infinity,"variance":NaN,"mean":NaN,"count":0,"std_deviation":NaN,"sum":0.0}

I obtain the following request and reponse when I click on "Generate chart" :
Request

GET /a/search/fieldhistogram?rangetype=absolute&q=&field=rip&interval=hour&valueType=mean&streamId=&from=2015-05-05T00%3A00%3A00.000Z&to=2015-05-06T00%3A00%3A00.000Z HTTP/1.1
Host: graylog:9000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: */*
Accept-Language: en-gb,en;q=0.8,de;q=0.5,fr;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: http://graylog:9000/search?rangetype=absolute&fields=message%2Csource&width=1680&from=2015-05-05T00%3A00%3A00.000Z&to=2015-05-06T00%3A00%3A00.000Z&q=
Cookie: PLAY_SESSION=d21777087737e3634f039088f8b5c4e77f3245fe-disconnected_orig_uri=%2Fstartpage&sessionid=2a6e43ce5efbb4ac60ff72cf19eac530843bd28f1e6a6b561c6ff0404029c549d3fc7cc48924c7ca100338690889480a
Connection: keep-alive

Response

HTTP/1.1 500 Internal Server Error
Cache-Control: no-cache
Content-Type: text/plain; charset=utf-8
Content-Length: 372

api exception org.graylog2.restclient.lib.APIException: API call failed GET http://@127.0.0.1:12900/search/universal/absolute/fieldhistogram?filter=*&field=rip&query=*&interval=hour&from=2015-05-05T00:00:00.000Z&to=2015-05-06T00:00:00.000Z&range_type=absolute returned 500 Internal Server Error body: {"type":"ApiError","message":"Adding time zone offset caused overflow"}

In the log, I found this stacktrace but I don't understand where is the problem (in my data or in graylog) :

2015-06-19 17:07:47,365 ERROR: org.graylog2.shared.rest.exceptionmappers.AnyExceptionClassMapper - Unhandled exception in REST resource
java.lang.ArithmeticException: Adding time zone offset caused overflow
        at org.joda.time.DateTimeZone.convertUTCToLocal(DateTimeZone.java:929)
        at org.joda.time.chrono.ZonedChronology$ZonedDateTimeField.get(ZonedChronology.java:422)
        at org.joda.time.base.BaseDateTime.<init>(BaseDateTime.java:129)
        at org.joda.time.base.BaseDateTime.<init>(BaseDateTime.java:97)
        at org.joda.time.MutableDateTime.<init>(MutableDateTime.java:209)
        at org.graylog2.indexer.results.FieldHistogramResult.getResults(FieldHistogramResult.java:77)
        at org.graylog2.rest.resources.search.SearchResource.buildHistogramResult(SearchResource.java:182)
        at org.graylog2.rest.resources.search.AbsoluteSearchResource.fieldHistogramAbsolute(AbsoluteSearchResource.java:301)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:497)
        at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:164)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:181)
        at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:203)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:101)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102)
        at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:305)
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271)
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:267)
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317)
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:288)
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1110)
        at org.graylog2.jersey.container.netty.NettyContainer.messageReceived(NettyContainer.java:356)
        at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
        at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
        at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
        at org.jboss.netty.handler.execution.ChannelUpstreamEventRunnable.doRun(ChannelUpstreamEventRunnable.java:43)
        at org.jboss.netty.handler.execution.ChannelEventRunnable.run(ChannelEventRunnable.java:67)
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176)
        at org.jboss.netty.handler.execution.MemoryAwareThreadPoolExecutor$MemoryAwareRunnable.run(MemoryAwareThreadPoolExecutor.java:622)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

Is it a bug in graylog or does it become from my data ?
Is it the same bug for "Statistics" and "Chart" ?

@joschi

This comment has been minimized.

Contributor

joschi commented Jun 23, 2015

Thanks for reporting this issue! It looks like this is a bug in Graylog. Even malicious data should never trigger such an exception.

Could you please provide some messages which cause this error? And which timezone is configured on the system running the Graylog server?

@lafeuil

This comment has been minimized.

lafeuil commented Jun 24, 2015

I agree with you about even malicious data should never trigger such an exception.

I have a TCP Input with two extractors. The first extracts data with grok pattern and extract the field localtime. For example, localtime : "05/May/2015:07:00:00 +0200".
The second extractor is a Timestamp Extractor that copies the field localtime and convert string to date type with the pattern "dd/MMM/yyyy:HH:mm:ss Z".

I think this is correct because the message have a correct timestamp when I search it :
"localtime" : "05/May/2015:07:00:00 +0200"
"timestamp" : "2015-05-05 05:00:00.000"

The timezone on the system running the graylog server is :
$ date +"%Z %z"
CEST +0200

joschi added a commit that referenced this issue Jul 21, 2015

@joschi joschi added the bug label Jul 21, 2015

@joschi joschi added this to the 1.2.0 milestone Jul 21, 2015

@joschi joschi self-assigned this Jul 21, 2015

@bernd bernd closed this in #1314 Jul 27, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment