Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

data loss when pipeline rule throws an exception #5406

Open
mbunkus opened this issue Dec 13, 2018 · 0 comments
Open

data loss when pipeline rule throws an exception #5406

mbunkus opened this issue Dec 13, 2018 · 0 comments

Comments

@mbunkus
Copy link

mbunkus commented Dec 13, 2018

This is the more general issue raised in #5405.

Expected behavior

Any message arriving in Graylog that is not explicitly discarded by the admin should end up in the database, no matter what.

Current behavior

If a Java exception is thrown during the execution of a rule in a pipeline, processing of that message cedes immediately and the message is lost. It is not stored in the database.

Possible Solution

I would argue that data must never be lost. Instead the current pipeline should be aborted, but message processing should continue somehow, at least end up in the database and the All messages stream.

Additionally the admin should be notified, both by email (there's a root_email attribute in the server.yml config file, after all) and by popup error messages (similar to e.g. when an input fails to start). At the moment the exception is reduced to a warning in the log file, and the fact that data loss occurred is not mentioned anywhere.

Steps to Reproduce (for bugs)

Please see #5405 for detailed instructions how to reproduce the issue. Instead of using the simulator, simply create the pipeline & rule as mentioned there, connect it to the All messages stream and create a message containing solely an IPv6 address, e.g. via logger 2001:db8::1

Your Environment

  • Graylog Version: 2.4.6-1 (Ubuntu package from Graylog's repo)
  • Elasticsearch Version: 5.6.13 (Ubuntu package from Elastico's repo)
  • MongoDB Version: 4.0.4 (Ubuntu package from MongoDB.org's repo)
  • Operating System: Ubuntu 18.04
@florianpopp florianpopp added bug and removed feature labels Jan 10, 2019
@bernd bernd added this to the 3.1.0 milestone Jan 14, 2019
@deeshe deeshe modified the milestone: 3.1.0 Apr 25, 2019
@bernd bernd removed this from the 3.1.0-legacy milestone Jan 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants