[libbeat] - replace processor panics for non-string values

[andrewkroh]

When the replace processor executes on a value that is not a string it will panic.

• input panic with: interface conversion: interface {} is nil, not string
• input panic with: interface conversion: interface {} is float64, not string

Full panic

input panic with: interface conversion: interface {} is float64, not string
goroutine 30 [running]:
runtime/debug.Stack()
	runtime/debug/stack.go:24 +0x64
github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource.func1()
	github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:144 +0x48
panic({0x10520cc20?, 0x14001971320?})
	runtime/panic.go:770 +0x124
github.com/elastic/beats/v7/libbeat/processors/actions.(*replaceString).replaceField(0x140015b5830, {0x14001058048, 0x18}, 0x14000b16780, {0x1085673a0, 0x1}, 0x1400196eb40)
	github.com/elastic/beats/v7/libbeat/processors/actions/replace.go:118 +0x204
github.com/elastic/beats/v7/libbeat/processors/actions.(*replaceString).Run(0x140015b5830, 0x1400196eb40)
	github.com/elastic/beats/v7/libbeat/processors/actions/replace.go:92 +0xa4
github.com/elastic/beats/v7/libbeat/publisher/processing.(*group).Run(0x140015b5920, 0x1400196eb40?)
	github.com/elastic/beats/v7/libbeat/publisher/processing/processors.go:128 +0x84
github.com/elastic/beats/v7/libbeat/publisher/processing.(*group).Run(0x140015b58f0, 0x10560bae0?)
	github.com/elastic/beats/v7/libbeat/publisher/processing/processors.go:128 +0x84
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*client).publish(0x1400087e070, {{0xc1d9d2c72bb18fe8, 0x65b9fb7, 0x10880fee0}, 0x0, 0x14001970b70, {0x0, 0x0}, 0x0})
	github.com/elastic/beats/v7/libbeat/publisher/pipeline/client.go:93 +0xec
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*client).Publish(0x1092aff48?, {{0xc1d9d2c72bb18fe8, 0x65b9fb7, 0x10880fee0}, 0x0, 0x14001970b70, {0x0, 0x0}, 0x0})
	github.com/elastic/beats/v7/libbeat/publisher/pipeline/client.go:73 +0xf8
github.com/elastic/beats/v7/filebeat/beater.(*countingClient).Publish(0x14000f9acc0, {{0xc1d9d2c72bb18fe8, 0x65b9fb7, 0x10880fee0}, 0x0, 0x14001970b70, {0x0, 0x0}, 0x0})
	github.com/elastic/beats/v7/filebeat/beater/channels.go:136 +0xa0
github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*cursorPublisher).forward(0x140015b5e30, {{0xc1d9d2c72bb18fe8, 0x65b9fb7, 0x10880fee0}, 0x0, 0x14001970b70, {0x0, 0x0}, 0x0})
	github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/publish.go:81 +0x6c
github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*cursorPublisher).Publish(0x105107660?, {{0xc1d9d2c72bb18fe8, 0x65b9fb7, 0x10880fee0}, 0x0, 0x14001970b70, {0x0, 0x0}, 0x0}, {0x0?, ...})
	github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/publish.go:68 +0xe0
github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1()
	github.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:484 +0x1974
github.com/elastic/beats/v7/x-pack/filebeat/input/cel.periodically({0x105a56588, 0x1400003a9b0}, 0xdf8475800, 0x14001927210)
	github.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:547 +0x34
github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run({_}, {0x14000fa9240, {0x1400007e4e0, 0x1a}, {0x140018ac6a0, 0x10}, {{0x10421d913, 0x8}, {0x10421d913, 0x8}, ...}, ...}, ...)
	github.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:224 +0x6d4
github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.Run({_}, {0x14000fa9240, {0x1400007e4e0, 0x1a}, {0x140018ac6a0, 0x10}, {{0x10421d913, 0x8}, {0x10421d913, 0x8}, ...}, ...}, ...)
	github.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:119 +0x110
github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource(_, {0x14000fa9240, {0x1400007e4e0, 0x1a}, {0x140018ac6a0, 0x10}, {{0x10421d913, 0x8}, {0x10421d913, 0x8}, ...}, ...}, ...)
	github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:168 +0x398
github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).Run.func1()
	github.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:123 +0x178
github.com/elastic/go-concert/unison.(*MultiErrGroup).Go.func1()
	github.com/elastic/[email protected]/unison/multierrgroup.go:42 +0x6c
created by github.com/elastic/go-concert/unison.(*MultiErrGroup).Go in goroutine 100
	github.com/elastic/[email protected]/unison/multierrgroup.go:40 +0x84

Origin:

beats/libbeat/processors/actions/replace.go

Line 111 in 48e4af4

updatedString := pattern.ReplaceAllString(currentValue.(string), replacement)

---

For confirmed bugs, please report:

• Version: 8.15.2
• Operating System: n/a
• Steps to Reproduce:

---

filebeat.inputs:
  - type: cel
    interval: 1m
    resource:
      url: NOT_USED
    redact:
      fields: ~
    keep_null: true
    program: |
      {
          'want_more': false,
          'events': [
              {"okta":{"profile":{"mobilePhone":null}}}, // PANIC
              {"okta":{"profile":{"mobilePhone":"555-555-55555"}}},
              {"okta":{"profile":{"mobilePhone":55555555555}}}, // PANIC
          ],
      }
    processors:
      - replace:
          fields:
            - field: okta.profile.mobilePhone
              pattern: '\d'
              replacement: X
          ignore_missing: true

output.console.pretty: true

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[mauri870]

What would be the desired behavior in this case? We clearly don't want to panic, but should we error out or cast the field to string if possible?

[andrewkroh]

I would expect an error. I would not want an implicit cast. There is a explicit way to cast if a user desires a cast to string (via convert).