From 72f4afb70b2e3c5e3e47319fc3ae2179d3c38e5f Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Thu, 5 Sep 2024 07:21:25 +0930 Subject: [PATCH] x-pack/filebeat/input/cel: improve missing events error value (#40580) CEL programs used in the CEL input are specific to return an object that includes an array. This is tested for, but currently the check is indirect and only shows that the type is not expected, rather than a more informative message that the events array is missing. This changes that so that when no events field is present, an error is returned directly. This will flow on to a status update in the handling of the returned error by the input Run method, alerting the user more promptly to the cause. Since a CEL input program is not valid if it returns no events field, a hard error (fleet status failed rather than degraded) seems appropriate. --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/input/cel/input.go | 4 +--- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0ece7c88964..65a6af33c34 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -297,6 +297,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Add new metricset cluster for the vSphere module. {pull}40536[40536] - Disable event normalization for netflow input {pull}40635[40635] - Allow attribute selection in the Active Directory entity analytics provider. {issue}40482[40482] {pull}40662[40662] +- Improve error quality when CEL program does not correctly return an events array. {pull}40580[40580] *Auditbeat* diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go index 99d5cfad788..2096383de39 100644 --- a/x-pack/filebeat/input/cel/input.go +++ b/x-pack/filebeat/input/cel/input.go @@ -366,9 +366,7 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p e, ok := state["events"] if !ok { - log.Error("unexpected missing events array from evaluation") - env.UpdateStatus(status.Degraded, "unexpected missing events array from evaluation") - isDegraded = true + return errors.New("unexpected missing events array from evaluation") } var events []interface{} switch e := e.(type) {