Skip to content

Conversation

@mauri870
Copy link
Member

@mauri870 mauri870 commented Dec 1, 2025

Proposed commit message

When the dissect processor is instantiated with an invalid field name
in the tokenizer config option, it panics. The code assumes any string
is a valid field name and doesn't validate the regex results.

If the field name cannot be parsed, return an error instead of panicking.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
  • I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

Author's Checklist

  • [ ]

How to test this PR locally

It panics on main and returns a startup error with this PR:

go run ./x-pack/filebeat -e -c <(cat << 'EOF'
processors:
  - dissect:
      tokenizer: "%{\n}"
      field: "message"
      target_prefix: "dissect"
EOF
)

# Exiting: error initializing processors: invalid field name accessing 'processors.0.dissect.tokenizer'

Related issues

  • Redacted, see linked issues.

@mauri870 mauri870 self-assigned this Dec 1, 2025
@mauri870 mauri870 added Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team backport-active-all Automated backport with mergify to all the active branches labels Dec 1, 2025
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 1, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 1, 2025

🤖 GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@mauri870 mauri870 marked this pull request as ready for review December 2, 2025 11:08
@mauri870 mauri870 requested a review from a team as a code owner December 2, 2025 11:08
@mauri870 mauri870 requested review from faec and leehinman December 2, 2025 11:08
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@mauri870 mauri870 added the bugfix label Dec 2, 2025
@mauri870
Copy link
Member Author

mauri870 commented Dec 3, 2025

Friendly ping for review. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-active-all Automated backport with mergify to all the active branches bugfix Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants