From 8d72d4548e73ef2c269b773d71611c06bef295bf Mon Sep 17 00:00:00 2001 From: Andy Hunt Date: Wed, 5 Jun 2019 17:48:14 +0100 Subject: [PATCH 1/4] Change logging behaviour with renameFields --- libbeat/processors/actions/rename.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libbeat/processors/actions/rename.go b/libbeat/processors/actions/rename.go index 2a94b9f834ea..c0c8f7787455 100644 --- a/libbeat/processors/actions/rename.go +++ b/libbeat/processors/actions/rename.go @@ -76,12 +76,14 @@ func (f *renameFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { err := f.renameField(field.From, field.To, event.Fields) - if err != nil && f.config.FailOnError { + if err != nil { errMsg := fmt.Errorf("Failed to rename fields in processor: %s", err) logp.Debug("rename", errMsg.Error()) - event.Fields = backup - event.PutValue("error.message", errMsg.Error()) - return event, err + if f.config.FailOnError { + event.Fields = backup + event.PutValue("error.message", errMsg.Error()) + return event, err + } } } From 862e4d147d7b2c2dc48f5ca25c72380506ee5b4e Mon Sep 17 00:00:00 2001 From: Andy Hunt Date: Wed, 5 Jun 2019 17:48:14 +0100 Subject: [PATCH 2/4] Revert "Change logging behaviour with renameFields" This reverts commit 8d72d4548e73ef2c269b773d71611c06bef295bf. --- libbeat/processors/actions/rename.go | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/libbeat/processors/actions/rename.go b/libbeat/processors/actions/rename.go index c0c8f7787455..2a94b9f834ea 100644 --- a/libbeat/processors/actions/rename.go +++ b/libbeat/processors/actions/rename.go @@ -76,14 +76,12 @@ func (f *renameFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { err := f.renameField(field.From, field.To, event.Fields) - if err != nil { + if err != nil && f.config.FailOnError { errMsg := fmt.Errorf("Failed to rename fields in processor: %s", err) logp.Debug("rename", errMsg.Error()) - if f.config.FailOnError { - event.Fields = backup - event.PutValue("error.message", errMsg.Error()) - return event, err - } + event.Fields = backup + event.PutValue("error.message", errMsg.Error()) + return event, err } } From 764a008c2d7d88af99d1b16c031dc77622240204 Mon Sep 17 00:00:00 2001 From: Andy Hunt Date: Thu, 6 Jun 2019 10:37:46 +0100 Subject: [PATCH 3/4] Separate logging behaviour from fail_on_error --- libbeat/processors/actions/copy_fields.go | 10 ++++++---- libbeat/processors/actions/rename.go | 10 ++++++---- libbeat/processors/actions/truncate_fields.go | 8 +++++--- 3 files changed, 17 insertions(+), 11 deletions(-) diff --git a/libbeat/processors/actions/copy_fields.go b/libbeat/processors/actions/copy_fields.go index ec82cfa3e028..af5709d54e16 100644 --- a/libbeat/processors/actions/copy_fields.go +++ b/libbeat/processors/actions/copy_fields.go @@ -72,12 +72,14 @@ func (f *copyFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { err := f.copyField(field.From, field.To, event.Fields) - if err != nil && f.config.FailOnError { + if err != nil { errMsg := fmt.Errorf("Failed to copy fields in copy_fields processor: %s", err) logp.Debug("copy_fields", errMsg.Error()) - event.Fields = backup - event.PutValue("error.message", errMsg.Error()) - return event, err + if f.config.FailOnError { + event.Fields = backup + event.PutValue("error.message", errMsg.Error()) + return event, err + } } } diff --git a/libbeat/processors/actions/rename.go b/libbeat/processors/actions/rename.go index 2a94b9f834ea..c0c8f7787455 100644 --- a/libbeat/processors/actions/rename.go +++ b/libbeat/processors/actions/rename.go @@ -76,12 +76,14 @@ func (f *renameFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { err := f.renameField(field.From, field.To, event.Fields) - if err != nil && f.config.FailOnError { + if err != nil { errMsg := fmt.Errorf("Failed to rename fields in processor: %s", err) logp.Debug("rename", errMsg.Error()) - event.Fields = backup - event.PutValue("error.message", errMsg.Error()) - return event, err + if f.config.FailOnError { + event.Fields = backup + event.PutValue("error.message", errMsg.Error()) + return event, err + } } } diff --git a/libbeat/processors/actions/truncate_fields.go b/libbeat/processors/actions/truncate_fields.go index d924da381a56..ca87eb35c5e4 100644 --- a/libbeat/processors/actions/truncate_fields.go +++ b/libbeat/processors/actions/truncate_fields.go @@ -85,10 +85,12 @@ func (f *truncateFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { event, err := f.truncateSingleField(field, event) - if err != nil && f.config.FailOnError { + if err != nil { logp.Debug("truncate_fields", "Failed to truncate fields: %s", err) - event.Fields = backup - return event, err + if f.config.FailOnError { + event.Fields = backup + return event, err + } } } From 4f5967953035672527fa2132e36697e95882461b Mon Sep 17 00:00:00 2001 From: Andy Hunt Date: Fri, 7 Jun 2019 12:36:09 +0100 Subject: [PATCH 4/4] Decouple debug logging behaviour from fail_on_error value --- CHANGELOG.next.asciidoc | 1 + libbeat/processors/actions/copy_fields.go | 10 ++++------ libbeat/processors/actions/rename.go | 10 ++++------ libbeat/processors/actions/truncate_fields.go | 8 +++----- 4 files changed, 12 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 819a85e96688..e973887c99f8 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -161,6 +161,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Affecting all Beats* +- Decouple Debug logging from fail_on_error logic for rename, copy, truncate processors {pull}12451[12451] - Add an option to append to existing logs rather than always rotate on start. {pull}11953[11953] - Add `network` condition to processors for matching IP addresses against CIDRs. {pull}10743[10743] - Add if/then/else support to processors. {pull}10744[10744] diff --git a/libbeat/processors/actions/copy_fields.go b/libbeat/processors/actions/copy_fields.go index af5709d54e16..ec82cfa3e028 100644 --- a/libbeat/processors/actions/copy_fields.go +++ b/libbeat/processors/actions/copy_fields.go @@ -72,14 +72,12 @@ func (f *copyFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { err := f.copyField(field.From, field.To, event.Fields) - if err != nil { + if err != nil && f.config.FailOnError { errMsg := fmt.Errorf("Failed to copy fields in copy_fields processor: %s", err) logp.Debug("copy_fields", errMsg.Error()) - if f.config.FailOnError { - event.Fields = backup - event.PutValue("error.message", errMsg.Error()) - return event, err - } + event.Fields = backup + event.PutValue("error.message", errMsg.Error()) + return event, err } } diff --git a/libbeat/processors/actions/rename.go b/libbeat/processors/actions/rename.go index c0c8f7787455..2a94b9f834ea 100644 --- a/libbeat/processors/actions/rename.go +++ b/libbeat/processors/actions/rename.go @@ -76,14 +76,12 @@ func (f *renameFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { err := f.renameField(field.From, field.To, event.Fields) - if err != nil { + if err != nil && f.config.FailOnError { errMsg := fmt.Errorf("Failed to rename fields in processor: %s", err) logp.Debug("rename", errMsg.Error()) - if f.config.FailOnError { - event.Fields = backup - event.PutValue("error.message", errMsg.Error()) - return event, err - } + event.Fields = backup + event.PutValue("error.message", errMsg.Error()) + return event, err } } diff --git a/libbeat/processors/actions/truncate_fields.go b/libbeat/processors/actions/truncate_fields.go index ca87eb35c5e4..d924da381a56 100644 --- a/libbeat/processors/actions/truncate_fields.go +++ b/libbeat/processors/actions/truncate_fields.go @@ -85,12 +85,10 @@ func (f *truncateFields) Run(event *beat.Event) (*beat.Event, error) { for _, field := range f.config.Fields { event, err := f.truncateSingleField(field, event) - if err != nil { + if err != nil && f.config.FailOnError { logp.Debug("truncate_fields", "Failed to truncate fields: %s", err) - if f.config.FailOnError { - event.Fields = backup - return event, err - } + event.Fields = backup + return event, err } }