Skip to content

Commit d2b5590

Browse files
authored
Merge pull request #1743 from ashnwade/patch-to-main
Release/v5.8.9: Merge next-patch to main
2 parents 60b8690 + 8e76dea commit d2b5590

File tree

10 files changed

+197
-7
lines changed

10 files changed

+197
-7
lines changed

_static/versions.json

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
[
22
{
3-
"name": "v5.8.8 (latest)",
4-
"version": "v5.8.8",
3+
"name": "v5.8.9 (latest)",
4+
"version": "v5.8.9",
55
"url": "/",
66
"preferred": true
77
},
8+
{
9+
"version": "v5.8.8",
10+
"url": "/v5.8.8/"
11+
},
812
{
913
"version": "v5.8.7",
1014
"url": "/v5.8.7/"

changelog/5.8.9.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Changelog for version 5.8.9
2+
3+
## Released 11 December 2025
4+
5+
## Gravwell
6+
7+
```{attention}
8+
This release contains a high priority bug fix for a security violation where secrets were not properly masked in error messages when running scripts. Secrets may be exposed in notifications or stored in log messages as a result of the script. See the remediation and validation section below.
9+
```
10+
11+
### Additions
12+
13+
* Added a flag in the [regex](/search/regex/regex.md) module to enable array mode, which extracts all matches of each capture group into array enumerated values.
14+
* Added an [`evs_to_json()`](#eval-evs-to-json) function to the eval module to return a JSON object of all the EVs on a given entry.
15+
16+
### Bug Fixes
17+
18+
* Fixed an issue where secrets were not properly masked in error messages when running scripts.
19+
* Fixed an issue where the tooltip was incorrect for cron specs with multiple hour ranges.
20+
* Fixed an issue where the webserver could sometimes lock-up when using direct search with a query attempting to write to a read-only resource.
21+
22+
## Ingester Changes
23+
24+
### Additions
25+
26+
* Added a [Regex Replace Preprocessor](/ingesters/preprocessors/regexreplace) to perform regular expression-based find and replace operations on entry data.
27+
28+
### Bug Fixes
29+
30+
* Fixed version numbers on macOS ingesters.
31+
32+
33+
## Remediation and Validation
34+
35+
The secret leakage occurs when a script directly embeds a secret into an error message and returns the error during execution. Secrets are and were properly masked if the error messages were simply printed as debug messages in the script but were not properly masked during the error handling logic. We have found a few instances where this bug could expose secrets:
36+
37+
1. A script deliberately creates an error message with the embedded secret and returns it.
38+
2. A script embeds a secret as part of an SQL connection string and then fails to connect to an SQL server then returns the SQL connection error.
39+
3. A script uses a secret as part of a hostname for a connection string and a DNS lookup fails.
40+
41+
42+
Unfortunately error messages from scripts are logged to the `gravwell` tag which further exacerbates the leak. Gravwell highly recommends users change secrets which have been used in the SQL and network connection strings in scripts.
43+
44+
To validate if secrets have been leaked as a result of scripts returning them in errors, the following query will identify errors strings from scripts:
45+
46+
47+
```gravwell
48+
tag=gravwell syslog -s Appname == searchagent Message == error name error
49+
| table TIMESTAMP error
50+
```
51+
52+
53+
To check a specific script filter on the name EV.
54+
```gravwell
55+
tag=gravwell syslog -s Appname == searchagent Message == error name=="test" error
56+
| table TIMESTAMP error
57+
```

changelog/list.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
maxdepth: 1
88
caption: Current Release
99
---
10-
5.8.8 <5.8.8>
10+
5.8.9 <5.8.9>
1111
```
1212

1313
## Previous Versions
@@ -18,6 +18,7 @@ maxdepth: 1
1818
caption: Previous Releases
1919
---
2020
21+
5.8.8 <5.8.8>
2122
5.8.7 <5.8.7>
2223
5.8.6 <5.8.6>
2324
5.8.5 <5.8.5>

conf.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
project = "Gravwell"
2323
copyright = f"Gravwell, Inc. {date.today().year}"
2424
author = "Gravwell, Inc."
25-
release = "v5.8.8"
25+
release = "v5.8.9"
2626

2727
# Default to localhost:8000, so the version switcher looks OK on livehtml
2828
version_list_url = os.environ.get(

ingesters/preprocessors/preprocessors.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ srcrouter <srcrouter>
128128
tagrouter <tagRouter>
129129
regextimestamp <regextimestamp>
130130
regexextract <regexextract>
131+
regexreplace <regexreplace>
131132
forwarder <forwarder>
132133
gravwellforwarder <gravwellforwarder>
133134
drop <drop>
@@ -150,6 +151,7 @@ plugin <plugin>
150151
| [tagrouter](tagRouter) | Route entries to specific tags based on the tag, or a combination of tag and either IP address or network |
151152
| [regextimestamp](regextimestamp) | Perform complex timestamp processing using regular expressions |
152153
| [regexextract](regexextract) | Perform data extractions and repacking using regular expressions |
154+
| [regexreplace](regexreplace) | Perform regex-based find and replace operations on entries |
153155
| [forwarder](forwarder) | Forward entries using TCP or UDP connections |
154156
| [gravwellforwarder](gravwellforwarder) | Forward entries using a Gravwell ingest connection |
155157
| [drop](drop) | Simple dropping preprocessor, it stops all entries from moving through the preprocessor chain |
Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Regex Replace Preprocessor
2+
3+
The Regex Replace preprocessor performs regular expression-based find and replace operations on entry data. This is useful for sanitizing sensitive data, normalizing log formats, or transforming data before ingestion.
4+
5+
The Regex Replace preprocessor Type is `regexreplace`.
6+
7+
## Supported Options
8+
9+
* `Regex` (string, required): The regular expression pattern to match against entry data. Supports standard Go regular expression syntax including named capture groups.
10+
* `Replacement` (string, required): The replacement string. Can reference capture groups using `$1`, `$2`, etc. for numbered groups or `${name}` for named groups.
11+
* `Case-Sensitive` (boolean, optional): When set to `true`, the regex matching is case-sensitive. When `false` (the default), matching is case-insensitive.
12+
13+
## Common Use Cases
14+
15+
The regexreplace preprocessor is commonly used for:
16+
17+
* Sanitizing sensitive data
18+
* Normalizing log formats across different sources
19+
* Stripping or replacing unwanted characters or patterns
20+
* Transforming data for easier downstream processing
21+
22+
### Example: Redacting Numbers
23+
24+
To redact all numbers from log entries (e.g., for removing phone numbers, IDs, or other sensitive numeric data):
25+
26+
```
27+
Phone: 123-456-7890, Age: 25, ID: 987654321
28+
```
29+
30+
Use the following configuration:
31+
32+
```
33+
[Preprocessor "redact-numbers"]
34+
Type=regexreplace
35+
Regex=`\d+`
36+
Replacement=`REDACTED`
37+
```
38+
39+
The result is:
40+
41+
```
42+
Phone: REDACTED-REDACTED-REDACTED, Age: REDACTED, ID: REDACTED
43+
```
44+
45+
### Example: Case-Insensitive Replacement
46+
47+
To replace all occurrences of a word regardless of case:
48+
49+
```
50+
This is a TEST string with Test words
51+
```
52+
53+
Use the following configuration:
54+
55+
```
56+
[Preprocessor "normalize-test"]
57+
Type=regexreplace
58+
Regex=`test`
59+
Replacement=`example`
60+
Case-Sensitive=false
61+
```
62+
63+
The result is:
64+
65+
```
66+
This is a example string with example words
67+
```
68+
69+
### Example: Modifying JSON Fields
70+
71+
Given JSON log data where you want to modify a specific field:
72+
73+
```
74+
{"name":"john","age":30,"city":"new york"}
75+
```
76+
77+
Use named capture groups to extract and modify the value:
78+
79+
```
80+
[Preprocessor "modify-json"]
81+
Type=regexreplace
82+
Regex=`"name":"(?P<n>[^"]*)"`
83+
Replacement=`"name":"${n}_modified"`
84+
Case-Sensitive=true
85+
```
86+
87+
The result is:
88+
89+
```
90+
{"name":"john_modified","age":30,"city":"new york"}
91+
```
92+

quickstart/quickstart.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ This guide is suitable for Community Edition users as well as users with a paid
5555

5656
You may find the [installation checklist](checklist) and the [glossary](/glossary/glossary) useful companions to this document.
5757

58-
If you are interested in a complete training package, please see the [complete training PDF](https://github.com/gravwell/training/releases/download/v5.8.8/gravwell_training_v5.8.8.pdf). The Gravwell training PDF is the complete training manual which is paired with labs and exercises. The exercises are built from the open source [Gravwell Training](https://github.com/gravwell/training) repository.
58+
If you are interested in a complete training package, please see the [complete training PDF](https://github.com/gravwell/training/releases/download/v5.8.9/gravwell_training_v5.8.9.pdf). The Gravwell training PDF is the complete training manual which is paired with labs and exercises. The exercises are built from the open source [Gravwell Training](https://github.com/gravwell/training) repository.
5959

6060
```{note}
6161
Community Edition users will need to obtain their own license from [https://www.gravwell.io/download](https://www.gravwell.io/download) before beginning installation. Paid users should already have received a license file via email.

search/eval/eval.md

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ Maps have a limit of 1000000 keys. Any new key assigned to a map after this limi
236236

237237
### Arrays
238238

239-
Eval supports the `array` enumerated value type. Arrays currently can only be created in the eval module and appear to other modules as string representations of the array contents (for example, `[ apple orange banana ]`).
239+
Eval supports the `array` enumerated value type. Arrays currently can only be created in the eval and regex modules and appear to other modules as string representations of the array contents (for example, `[ apple orange banana ]`).
240240

241241
#### Declaring arrays
242242

@@ -1051,6 +1051,27 @@ Sets a key/value pair in the given object. The value's type is evaluated at runt
10511051

10521052
Returns a Gravwell array enumerated value based on the given JSON array. JSON types are evaluated at runtime and individual array items will be set to their equivalent Gravwell types, or a string if no mapping exists.
10531053

1054+
(eval-evs-to-json)=
1055+
#### evs_to_json
1056+
1057+
function evs_to_json() string
1058+
1059+
Returns a JSON object containing all enumerated values attached to the current entry. Each EV name becomes a key in the JSON object, and the EV value is serialized to its corresponding JSON type (number, string, boolean, array, or object). Durations, MAC addresses, and timestamps are serialized as strings.
1060+
1061+
Example
1062+
1063+
```
1064+
tag=gravwell syslog Appname Hostname Message
1065+
| eval output = evs_to_json();
1066+
| table output
1067+
```
1068+
1069+
This would produce output like:
1070+
1071+
```
1072+
{"Appname":"webserver","Hostname":"potato","Message":"connection established"}
1073+
```
1074+
10541075

10551076
(eval-math)=
10561077
### Math

search/maclookup/maclookup.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Before using the maclookup module, you must have a database of MAC prefixes in a
1010

1111
## Supported Options
1212

13-
* `-r <arg>`: The “-r” option specifies the resource name or UUID which contains a macdb database. If no "-r" is specified, the geoip module uses the default "mac_prefixes" resource name.
13+
* `-r <arg>`: The “-r” option specifies the resource name or UUID which contains a macdb database. If no "-r" is specified, the maclookup module uses the default "mac_prefixes" resource name.
1414
* `-s`: The “-s” option specifies that the maclookup module should operate in strict mode. In strict mode, if any of the specified operators cannot resolve a MAC, the entry is dropped.
1515

1616
## Processing Operators

search/regex/regex.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ regex <argument list> <regular expression> [filter arguments]
2626
* `-r <arg>`: The “-r” option specifies that the regular expression statement is located in a resource file.
2727
* `-v`: The "-v" option tells regex to operate in inverse mode, dropping any entries which match the regex and passing entries which do not match.
2828
* `-p`: The "-p" option tells regex to allow entries through if the regular expression does not match at all. The permissive flag does not change the operation of filters.
29+
* `-a`: The "-a" option enables array mode, which extracts all matches of each capture group into array enumerated values instead of just the first match. This is useful when an entry contains multiple occurrences of a pattern.
2930

3031
```{note}
3132
Storing especially large regular expressions in resource files can clean up queries, and allows for easy reuse. If `-r` is specified, do not specify a regular expression in the query -- instead the contents of the resource will be used. Handy!
@@ -70,6 +71,18 @@ tag=syslog grep sshd | regex `shd.*Accepted (?P<method>\S*) for (?P<user>\S*) fr
7071
| table method user ip
7172
```
7273

74+
### Array Mode Example
75+
76+
The `-a` flag extracts all matches of each capture group into array enumerated values. This is useful when a single entry contains multiple occurrences of a pattern.
77+
78+
For example, to extract all numbers from each entry into an array:
79+
80+
```gravwell
81+
tag=default regex -a `(?P<num>\d+)` | table num
82+
```
83+
84+
If an entry contains "foo 123 bar 456 baz 789", the `num` enumerated value will be an array containing `[123, 456, 789]`.
85+
7386
## Full regular expression syntax
7487

7588
The following is copied from [the re2 documentation](https://github.com/google/re2/wiki/Syntax) (see [their license](https://raw.githubusercontent.com/google/re2/refs/heads/main/LICENSE))

0 commit comments

Comments
 (0)