Nice catch :) Happened to me with my first pipeline rule.
On Thursday, January 5, 2017 at 9:44:30 AM UTC-6, Frank wrote: > > Well, adding a "when" does certainly help, My bad! > > rule "blacklist" > when > contains(to_string($message.message), "systemd") > then > drop_message(); > end > > > On Thursday, January 5, 2017 at 4:29:48 PM UTC+1, Frank wrote: >> >> Hi there, >> >> I'm just making my first steps with processing pipelines, and want to >> create a rule that blacklists / drops certain messages. >> I'm trying to add a rule that looks like this: >> >> rule "blacklist" >> contains(to_string($message), "systemd") >> then >> drop_message($message) >> end >> >> >> When I click "Save" nothing happens and in server.log this appears: >> >> 2017-01-05T15:24:22.091Z ERROR [PipelineRuleParser] Unable to retrieve >> expression for variable contains, this is a bug >> 2017-01-05T15:24:22.093Z ERROR [AnyExceptionClassMapper] Unhandled >> exception in REST resource >> java.lang.NullPointerException >> at >> org.graylog.plugins.pipelineprocessor.parser.PipelineRuleParser$RuleTypeChecker.exitMessageRef(PipelineRuleParser.java:677) >> >> ~[?:?] >> at >> org.graylog.plugins.pipelineprocessor.parser.RuleLangParser$MessageRefContext.exitRule(RuleLangParser.java:672) >> >> ~[?:?] >> at >> org.antlr.v4.runtime.tree.ParseTreeWalker.exitRule(ParseTreeWalker.java:71) >> ~[?:?] >> at >> org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:54) >> ~[?:?] >> at >> org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) >> ~[?:?] >> at >> org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) >> ~[?:?] >> at >> org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) >> ~[?:?] >> at >> org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) >> ~[?:?] >> at >> org.graylog.plugins.pipelineprocessor.parser.PipelineRuleParser.parseRule(PipelineRuleParser.java:136) >> >> ~[?:?] >> at >> org.graylog.plugins.pipelineprocessor.rest.RuleResource.createFromParser(RuleResource.java:93) >> >> ~[?:?] >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> ~[?:1.8.0_111] >> at >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) >> >> ~[?:1.8.0_111] >> at >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) >> >> ~[?:1.8.0_111] >> at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_111] >> at >> org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) >> >> ~[graylog.jar:?] >> at >> org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) >> [graylog.jar:?] >> at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) >> [graylog.jar:?] >> at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) >> [graylog.jar:?] >> at org.glassfish.jersey.internal.Errors.process(Errors.java:315) >> [graylog.jar:?] >> at org.glassfish.jersey.internal.Errors.process(Errors.java:297) >> [graylog.jar:?] >> at org.glassfish.jersey.internal.Errors.process(Errors.java:267) >> [graylog.jar:?] >> at >> org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) >> >> [graylog.jar:?] >> at >> org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) >> [graylog.jar:?] >> at >> org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) >> >> [graylog.jar:?] >> at >> org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) >> >> [graylog.jar:?] >> at >> org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) >> [graylog.jar:?] >> at >> com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) >> >> [graylog.jar:?] >> at >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) >> >> [?:1.8.0_111] >> at >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) >> >> [?:1.8.0_111] >> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111] >> >> >> >> What am I doing wrong? >> >> Best, >> Frank >> > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/a1ec6d0e-0f21-46d9-bf12-e31559689de9%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
