[FLUME-2126] Problem in elasticsearch sink when the event body is a complex field

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.6.0
• Component/s: Sinks+Sources

Environment

1.3.1 and 1.4

• Assignee: Unassigned
• Reporter: Massimo Paladin
• Created: 12/Jul/13 15:07
• Updated: 19/Aug/15 18:52
• Resolved: 11/Mar/15 23:34

Description

I have found a bug in the elasticsearch sink, the problem is in the ContentBuilderUtil.addComplexField method, when it does builder.field(fieldName, tmp); the tmp object is taken as Object with the result of being serialized with the toString method in the XContentBuilder. In the end you get the object reference as content.

The following change workaround the problem for me, the bad point is that it has to parse the content twice, I guess there is a better way to solve the problem but I am not an elasticsearch api expert.

--- a/flume-ng-sinks/flume-ng-elasticsearch-sink/src/main/java/org/apache/flume/sink/elasticsearch/ContentBuilderUtil.java
+++ b/flume-ng-sinks/flume-ng-elasticsearch-sink/src/main/java/org/apache/flume/sink/elasticsearch/ContentBuilderUtil.java
@@ -61,7 +61,12 @@ public class ContentBuilderUtil {
       parser = XContentFactory.xContent(contentType).createParser(data);
       parser.nextToken();
       tmp.copyCurrentStructure(parser);
-      builder.field(fieldName, tmp);
+
+      // if it is a valid structure then we include it
+      parser = XContentFactory.xContent(contentType).createParser(data);
+      parser.nextToken();
+      builder.field(fieldName);
+      builder.copyCurrentStructure(parser);
     } catch (JsonParseException ex) {
       // If we get an exception here the most likely cause is nested JSON that
       // can't be figured out in the body. At this point just push it through

Issue Links

• is duplicated by: FLUME-2476 ContentBuilderUtil.appendField incorrectly manages json-like data
• is related to: FLUME-2649 Elasticsearch sink doesn't handle JSON fields correctly
• links to: Review Request