diff --git a/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/Grok.java b/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/Grok.java index 1902d9900f7..576a3b85eb3 100644 --- a/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/Grok.java +++ b/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/Grok.java @@ -29,7 +29,6 @@ import org.joni.Syntax; import org.joni.exception.ValueException; import java.nio.charset.StandardCharsets; -import java.util.Arrays; import java.util.HashMap; import java.util.Iterator; import java.util.Locale; @@ -107,8 +106,13 @@ final class Grok { // TODO(tal): Support definitions String definition = groupMatch(DEFINITION_GROUP, region, grokPattern); String patternName = groupMatch(PATTERN_GROUP, region, grokPattern); + String pattern = patternBank.get(patternName); + if (pattern == null) { + throw new IllegalArgumentException("Unable to find pattern [" + patternName + "] in Grok's pattern dictionary"); + } + String grokPart; if (namedCaptures && subName != null) { grokPart = String.format(Locale.US, "(?<%s>%s)", namedPatternRef, pattern); diff --git a/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokProcessorTests.java b/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokProcessorTests.java index 86bc780b75e..37c26db4b74 100644 --- a/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokProcessorTests.java +++ b/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokProcessorTests.java @@ -54,6 +54,16 @@ public class GrokProcessorTests extends ESTestCase { assertThat(e.getMessage(), equalTo("Provided Grok expressions do not match field value: [23]")); } + public void testNoMatchingPatternName() { + String fieldName = RandomDocumentPicks.randomFieldName(random()); + IngestDocument doc = RandomDocumentPicks.randomIngestDocument(random(), new HashMap<>()); + doc.setFieldValue(fieldName, "23"); + Exception e = expectThrows(IllegalArgumentException.class, () -> new GrokProcessor(randomAlphaOfLength(10), + Collections.singletonMap("ONE", "1"), Collections.singletonList("%{NOTONE:not_one}"), fieldName, + false, false)); + assertThat(e.getMessage(), equalTo("Unable to find pattern [NOTONE] in Grok's pattern dictionary")); + } + public void testMatchWithoutCaptures() throws Exception { String fieldName = "value"; IngestDocument originalDoc = new IngestDocument(new HashMap<>(), new HashMap<>()); diff --git a/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokTests.java b/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokTests.java index 8874853dcd1..7649727ca0f 100644 --- a/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokTests.java +++ b/modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/GrokTests.java @@ -24,6 +24,7 @@ import org.junit.Before; import java.io.IOException; import java.util.Arrays; +import java.util.Collections; import java.util.HashMap; import java.util.List; import java.util.Map; @@ -48,6 +49,11 @@ public class GrokTests extends ESTestCase { assertEquals(0, matches.size()); } + public void testNoMatchingPatternInDictionary() { + Exception e = expectThrows(IllegalArgumentException.class, () -> new Grok(Collections.emptyMap(), "%{NOTFOUND}")); + assertThat(e.getMessage(), equalTo("Unable to find pattern [NOTFOUND] in Grok's pattern dictionary")); + } + public void testSimpleSyslogLine() { String line = "Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]"; Grok grok = new Grok(basePatterns, "%{SYSLOGLINE}");