Affects Version/s: None
Fix Version/s: 0.6.0
If we use ExtractText and configure it with a regular expression that contains a Capturing Group that is "optional" (ends with a ?), and the regex matches some content where the capturing group is not present, then it will throw a NullPointerException
Conrad Crampton on the users mailing list reported:
I don’t know if this is expected behaviour but I think I understand why this is happening now. I have a regexp in the ExtractText processors viz:
) ([\d ]\d:\d\d:\d\d) Product=(.?) OriginIP=(.?) Origin=(.?) Action=(.?) SIP=(.?) Source=(.?) SPort=(\d+?) DIP=(.) Destination=(.?) DPort=(\d+?) Protocol=(.?)(?: ICMPType=(.?) ICMPCode=(.?))? IFName=(.?) IFDirection=(.?) Reason=(.?) Rule=(.?) PolicyName=(.?) Info=(.?) XlateSIP=(.?) XlateSPort=([\d]|
?) XlateDIP=(.?) XlateDPort=([\d]+|?)(.*)$)
With this (?: ICMPType=(.?) ICMPCode=(.?))? the problem I think. Because I have made a non capturing matching group optional, for those log lines that don’t have this section matching the dynamic variable can’t set the index correctly as the match is returning null for these capture groups. Obviously I haven’t gone too deep into the code, but if I have a RouteOnContent processor before this testing for this string and remove this from regexp (and have two ExtractText processors) then it works. It appeared that all the NPE were thrown for those lines that didn’t match the optional matching group.
Has this been observed before?
— In looking at the code this line looks offensive: