-
Notifications
You must be signed in to change notification settings - Fork 26
Description
Products/Versions (include any installed plugins):
Logstash 6.7 (also reproduce on Logstash 6.5.1)
logstash-filter-prune 3.0.3
logstash-filter-mutate 3.5.0
logstash-filter-cipher 4.0.0
Operating system:
Linux Ubuntu
Description:
The following use of filters is triggering errors on the cipher plugin:
prune {
blacklist_values => [ "message", "-"]
}
mutate {
lowercase => ["message"]
}
cipher {
algorithm => "aes-256-cbc"
cipher_padding => 1
iv_random_length => 16
key => "12345678901234567890123456789012"
key_size => 32
mode => "encrypt"
source => "message"
target => "encrypted_message"
base64 => true
max_cipher_reuse => 1
}
A number of errror are seen such as:
[2019-06-19T14:48:52,234][WARN ][logstash.filters.cipher ] Exception catch on cipher filter {:event=>#<LogStash::Event:0x57f70d58>, :error=>#<OpenSSL::Cipher::CipherError: Cipher not initialized>}
[2019-06-19T14:48:52,234][WARN ][logstash.filters.cipher ] Exception catch on cipher filter {:event=>#<LogStash::Event:0x452f4cbd>, :error=>#<OpenSSL::Cipher::CipherError: No message available>}
[2019-06-19T14:48:52,284][WARN ][logstash.filters.cipher ] Exception catch on cipher filter {:event=>#<LogStash::Event:0x7c5477d9>, :error=>#<NoMethodError: undefined method `update' for nil:NilClass>}
Important note: it is noticed the error is not seen is the number of worker is set to 1.
The test was done by setting the following value in logstash.yml file:
pipeline.workers:1
Hence the issue appears to be related to the fact we are not calling OpenSSL method in a thread safe way like the github issue linked above.
Steps to reproduce:
Setup a pipeline to parse logs as per tutorial below:
https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html
Then edit the conf file to use filters described above.
Run the pipeline.