Logstash Lines: Update for December 19, 2017

Von
Andrew Cholakian

Hello Logstashers! We're glad to present you all the past couple week's news in convenient digest form! This past week has been mostly about fixes. We have some big picture things we're working on, but nothing in enough shape to share yet.

  • 6.1.0/6.1.1 regression: JSON with empty keys can cause LS to crashWe already have a fix merged in. It didn't make 6.1.1, we are now targeting 6.1.2 for this fix.
  • We found a bug in the Beats input (thanks PH/Rob Bavey!) that caused it to leak file descriptors / TCP connections when under back pressure. This is fixed in LS 6.1.1 . Users of older Logstashes can upgrade the beats input plugin.
  • Fixed a bug where LS could crash due to bad interrupt code in grok
    The Logstash grok filter uses thread interrupts. We found a bug where in some cases we might not properly clear interrupts between invocations, causing subsequent code that throws interrupted exceptions to trigger in places where it might not be caught. This is fixed in 6.1.1 . Users of older Logstashes may upgrade their grok filter to the latest version.
  • Fixed stability / threadsafety problem in the UDP input
    The UDP input shared a codec among threads. Codecs are intentionally not threadsafe, and are supposed to be thread local. The fix in this case was to use separate codec instances for each UDP input worker thread. This has been patched and included in 6.1.1
  • This caused a test failure, but almost certainly not any real world ones. Up until this change set we used to traverse our graphs and hash them based on the contents of the graph representation. This is somewhat tricky and inherently fragile since any changes to the graph need to be incorporated into the hash. Since our IR includes the source code that generated that graph we just moved to hashing that, which is faster and more reliable.
  • One of our error messages for the ES output always showed the ES version as null, this fixes that.