[8.1] [ML] Text structure finder caps exclude lines pattern at 1000 characters #84239
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…haracters Because of the way Filebeat parses CSV files the text structure finder needs to generate a regular expression that will ignore the header row of the CSV file. It does this by concatenating the column names separated by the delimiter with optional quoting. However, if there are hundreds of columns this can lead to a very long regular expression, potentially one that cannot be evaluated by some programming languages. This change limits the length of the regular expression to 1000 characters by only including elements for the first few columns when there are many. Matching 1000 characters of header should be sufficient to reliably identify the header row even when it is much longer. It is extremely unlikely that there would be a data row where the first 1000 characters exactly matched the header but then subsequent fields diverged. Backport of elastic#84236
droberts195
added
backport
auto-merge-without-approval
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Because of the way Filebeat parses CSV files the text structure finder
needs to generate a regular expression that will ignore the header row
of the CSV file.
It does this by concatenating the column names separated by the delimiter
with optional quoting. However, if there are hundreds of columns this can
lead to a very long regular expression, potentially one that cannot be
evaluated by some programming languages.
This change limits the length of the regular expression to 1000 characters
by only including elements for the first few columns when there are many.
Matching 1000 characters of header should be sufficient to reliably
identify the header row even when it is much longer. It is extremely
unlikely that there would be a data row where the first 1000 characters
exactly matched the header but then subsequent fields diverged.
Backport of #84236