fix(libbeat): Prevent panic in replace processor for non-string values by orestisfl · Pull Request #47009 · elastic/beats

orestisfl · 2025-10-09T16:47:20Z

Proposed commit message

The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float).

This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types.

Closes #42308

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

How to test this PR locally

cfg=$(cat <<EOF
filebeat.inputs:
  - type: cel
    interval: 1m
    resource:
      url: NOT_USED
    redact:
      fields: ~
    keep_null: true
    program: |
      {
          'want_more': false,
          'events': [
              {"okta":{"profile":{"mobilePhone":null}}},
              {"okta":{"profile":{"mobilePhone":"555-555-55555"}}},
              {"okta":{"profile":{"mobilePhone":55555555555}}},
          ],
      }
    processors:
      - replace:
          fields:
            - field: okta.profile.mobilePhone
              pattern: '\d'
              replacement: X
          ignore_missing: true

output.console.pretty: true
EOF
)
x-pack/filebeat/filebeat -c <(echo "$cfg") -e

Before:

{"log.level":"info","@timestamp":"2025-10-09T20:12:16.302+0200","log.logger":"input.cel.metric_registry","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewMetricsRegistry","file.name":"inputmon/input.go","file.line":182},"message":"registering","service.name":"filebeat","id":"448BD05089734E53","registry_id":"448BD05089734E53","input_id":"448BD05089734E53","input_type":"cel","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-09T20:12:16.302+0200","log.logger":"input.cel.metric_registry","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewMetricsRegistry","file.name":"inputmon/input.go","file.line":182},"message":"registering","service.name":"filebeat","id":"448BD05089734E53","input_source":"NOT_USED","registry_id":"448BD05089734E53::NOT_USED","input_id":"448BD05089734E53::NOT_USED","input_type":"cel","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-09T20:12:16.303+0200","log.logger":"input.cel","log.origin":{"function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1","file.name":"cel/input.go","file.line":241},"message":"process periodic request","service.name":"filebeat","id":"448BD05089734E53","input_source":"NOT_USED","input_url":"NOT_USED","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-10-09T20:12:16.303+0200","log.logger":"input.cel","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource.func1","file.name":"input-cursor/input.go","file.line":173},"message":"Input crashed with: input panic with: interface conversion: interface {} is nil, not string\ngoroutine 106 [running]:\nruntime/debug.Stack()\n\truntime/debug/stack.go:26 +0x5e\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource.func1()\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:172 +0x58\npanic({0x607a9fe183a0?, 0xc000c7f140?})\n\truntime/panic.go:783 +0x132\ngithub.com/elastic/beats/v7/libbeat/processors/actions.(*replaceString).replaceField(0xc000c11260, {0xc00099a1e0, 0x18}, 0xc00084d180, {0x607a9f5828e0, 0x1}, 0xc000c925c0)\n\tgithub.com/elastic/beats/v7/libbeat/processors/actions/replace.go:118 +0x26b\ngithub.com/elastic/beats/v7/libbeat/processors/actions.(*replaceString).Run(0xc000c11260, 0xc000c925c0)\n\tgithub.com/elastic/beats/v7/libbeat/processors/actions/replace.go:92 +0xb7\ngithub.com/elastic/beats/v7/libbeat/publisher/processing.(*group).Run(0xc000c11350, 0xc000c925c0?)\n\tgithub.com/elastic/beats/v7/libbeat/publisher/processing/processors.go:127 +0x82\ngithub.com/elastic/beats/v7/libbeat/publisher/processing.(*group).Run(0xc000c11320, 0xc001105f01?)\n\tgithub.com/elastic/beats/v7/libbeat/publisher/processing/processors.go:127 +0x82\ngithub.com/elastic/beats/v7/libbeat/publisher/pipeline.(*client).publish(0xc000425ab0, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/libbeat/publisher/pipeline/client.go:93 +0x11a\ngithub.com/elastic/beats/v7/libbeat/publisher/pipeline.(*client).Publish(0x607a9e661ec7?, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/libbeat/publisher/pipeline/client.go:73 +0xfa\ngithub.com/elastic/beats/v7/filebeat/beater.(*countingClient).Publish(0xc000bdb4b8, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/filebeat/beater/channels.go:133 +0xa7\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*cursorPublisher).forward(0xc000c113e0, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/publish.go:81 +0x75\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*cursorPublisher).Publish(0x607a9eb28aa8?, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0}, {0x0, ...})\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/publish.go:68 +0x109\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1()\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:514 +0x1ead\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.periodically({0x607aa093f508, 0xc000c00460}, 0xdf8475800, 0xc000c57658)\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:580 +0x2e\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run({_}, {0xc000bdb380, {0xc000735120, 0x1a}, {0xc001105850, 0x10}, {0x607a9eb246cb, 0x3}, {{0x607a9eb2e48b, 0x8}, ...}, ...}, ...)\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:240 +0xa0b\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.Run({_}, {0xc000bdb380, {0xc000735120, 0x1a}, {0xc001105850, 0x10}, {0x607a9eb246cb, 0x3}, {{0x607a9eb2e48b, 0x8}, ...}, ...}, ...)\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:122 +0x132\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource(_, {0xc000bdb380, {0xc000735120, 0x1a}, {0xc001105850, 0x10}, {0x607a9eb246cb, 0x3}, {{0x607a9eb2e48b, 0x8}, ...}, ...}, ...)\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:196 +0x479\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).Run.func1()\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:151 +0x2f2\ngithub.com/elastic/go-concert/unison.(*MultiErrGroup).Go.func1()\n\tgithub.com/elastic/go-concert@v0.3.0/unison/multierrgroup.go:42 +0x66\ncreated by github.com/elastic/go-concert/unison.(*MultiErrGroup).Go in goroutine 104\n\tgithub.com/elastic/go-concert@v0.3.0/unison/multierrgroup.go:40 +0x76\n","service.name":"filebeat","id":"448BD05089734E53","input_source":"NOT_USED","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-09T20:12:16.303+0200","log.logger":"input.cel.metric_registry","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.CancelMetricsRegistry","file.name":"inputmon/input.go","file.line":198},"message":"unregistering","service.name":"filebeat","id":"448BD05089734E53","input_source":"NOT_USED","registry_id":"448BD05089734E53::NOT_USED","input_id":"448BD05089734E53::NOT_USED","input_type":"cel","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-10-09T20:12:16.303+0200","log.logger":"input.cel","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1","file.name":"compat/compat.go","file.line":164},"message":"Input 'cel' failed with: input 448BD05089734E53 failed: input panic with: interface conversion: interface {} is nil, not string\ngoroutine 106 [running]:\nruntime/debug.Stack()\n\truntime/debug/stack.go:26 +0x5e\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource.func1()\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:172 +0x58\npanic({0x607a9fe183a0?, 0xc000c7f140?})\n\truntime/panic.go:783 +0x132\ngithub.com/elastic/beats/v7/libbeat/processors/actions.(*replaceString).replaceField(0xc000c11260, {0xc00099a1e0, 0x18}, 0xc00084d180, {0x607a9f5828e0, 0x1}, 0xc000c925c0)\n\tgithub.com/elastic/beats/v7/libbeat/processors/actions/replace.go:118 +0x26b\ngithub.com/elastic/beats/v7/libbeat/processors/actions.(*replaceString).Run(0xc000c11260, 0xc000c925c0)\n\tgithub.com/elastic/beats/v7/libbeat/processors/actions/replace.go:92 +0xb7\ngithub.com/elastic/beats/v7/libbeat/publisher/processing.(*group).Run(0xc000c11350, 0xc000c925c0?)\n\tgithub.com/elastic/beats/v7/libbeat/publisher/processing/processors.go:127 +0x82\ngithub.com/elastic/beats/v7/libbeat/publisher/processing.(*group).Run(0xc000c11320, 0xc001105f01?)\n\tgithub.com/elastic/beats/v7/libbeat/publisher/processing/processors.go:127 +0x82\ngithub.com/elastic/beats/v7/libbeat/publisher/pipeline.(*client).publish(0xc000425ab0, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/libbeat/publisher/pipeline/client.go:93 +0x11a\ngithub.com/elastic/beats/v7/libbeat/publisher/pipeline.(*client).Publish(0x607a9e661ec7?, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/libbeat/publisher/pipeline/client.go:73 +0xfa\ngithub.com/elastic/beats/v7/filebeat/beater.(*countingClient).Publish(0xc000bdb4b8, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/filebeat/beater/channels.go:133 +0xa7\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*cursorPublisher).forward(0xc000c113e0, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0})\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/publish.go:81 +0x75\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*cursorPublisher).Publish(0x607a9eb28aa8?, {{0xc2321ca01217e269, 0x2474b34, 0x607aa457b340}, 0x0, 0xc000c7ede0, {0x0, 0x0}, 0x0}, {0x0, ...})\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/publish.go:68 +0x109\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1()\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:514 +0x1ead\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.periodically({0x607aa093f508, 0xc000c00460}, 0xdf8475800, 0xc000c57658)\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:580 +0x2e\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run({_}, {0xc000bdb380, {0xc000735120, 0x1a}, {0xc001105850, 0x10}, {0x607a9eb246cb, 0x3}, {{0x607a9eb2e48b, 0x8}, ...}, ...}, ...)\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:240 +0xa0b\ngithub.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.Run({_}, {0xc000bdb380, {0xc000735120, 0x1a}, {0xc001105850, 0x10}, {0x607a9eb246cb, 0x3}, {{0x607a9eb2e48b, 0x8}, ...}, ...}, ...)\n\tgithub.com/elastic/beats/v7/x-pack/filebeat/input/cel/input.go:122 +0x132\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).runSource(_, {0xc000bdb380, {0xc000735120, 0x1a}, {0xc001105850, 0x10}, {0x607a9eb246cb, 0x3}, {{0x607a9eb2e48b, 0x8}, ...}, ...}, ...)\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:196 +0x479\ngithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor.(*managedInput).Run.func1()\n\tgithub.com/elastic/beats/v7/filebeat/input/v2/input-cursor/input.go:151 +0x2f2\ngithub.com/elastic/go-concert/unison.(*MultiErrGroup).Go.func1()\n\tgithub.com/elastic/go-concert@v0.3.0/unison/multierrgroup.go:42 +0x66\ncreated by github.com/elastic/go-concert/unison.(*MultiErrGroup).Go in goroutine 104\n\tgithub.com/elastic/go-concert@v0.3.0/unison/multierrgroup.go:40 +0x76\n","service.name":"filebeat","id":"448BD05089734E53","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-09T20:12:16.303+0200","log.logger":"input.cel.metric_registry","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.CancelMetricsRegistry","file.name":"inputmon/input.go","file.line":198},"message":"unregistering","service.name":"filebeat","id":"448BD05089734E53","registry_id":"448BD05089734E53","input_id":"448BD05089734E53","input_type":"cel","ecs.version":"1.6.0"}

After:

{"log.level":"info","@timestamp":"2025-10-09T20:13:34.645+0200","log.logger":"input.cel.metric_registry","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewMetricsRegistry","file.name":"inputmon/input.go","file.line":182},"message":"registering","service.name":"filebeat","id":"448BD05089734E53","registry_id":"448BD05089734E53","input_id":"448BD05089734E53","input_type":"cel","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-09T20:13:34.645+0200","log.logger":"input.cel.metric_registry","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewMetricsRegistry","file.name":"inputmon/input.go","file.line":182},"message":"registering","service.name":"filebeat","id":"448BD05089734E53","input_source":"NOT_USED","registry_id":"448BD05089734E53::NOT_USED","input_id":"448BD05089734E53::NOT_USED","input_type":"cel","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-10-09T20:13:34.646+0200","log.logger":"input.cel","log.origin":{"function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1","file.name":"cel/input.go","file.line":241},"message":"process periodic request","service.name":"filebeat","id":"448BD05089734E53","input_source":"NOT_USED","input_url":"NOT_USED","ecs.version":"1.6.0"}
{
  "@timestamp": "2025-10-09T18:13:34.646Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.3.0"
  },
  "okta": {
    "profile": {
      "mobilePhone": null
    }
  },
  "input": {
    "type": "cel"
  },
  "error": {
    "message": "Failed to replace fields in processor: value for key: okta.profile.mobilePhone is not a string: <nil>"
  },
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "laptop"
  },
  "agent": {
    "name": "laptop",
    "type": "filebeat",
    "version": "9.3.0",
    "ephemeral_id": "c555ca4d-f5fd-48b3-b576-8ec6c875c6a3",
    "id": "edc593f4-2c3c-4d6a-b2dc-c10b6a80fbf0"
  }
}
{
  "@timestamp": "2025-10-09T18:13:34.646Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.3.0"
  },
  "agent": {
    "ephemeral_id": "c555ca4d-f5fd-48b3-b576-8ec6c875c6a3",
    "id": "edc593f4-2c3c-4d6a-b2dc-c10b6a80fbf0",
    "name": "laptop",
    "type": "filebeat",
    "version": "9.3.0"
  },
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "laptop"
  },
  "okta": {
    "profile": {
      "mobilePhone": "XXX-XXX-XXXXX"
    }
  },
  "input": {
    "type": "cel"
  }
}
{
  "@timestamp": "2025-10-09T18:13:34.646Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.3.0"
  },
  "error": {
    "message": "Failed to replace fields in processor: value for key: okta.profile.mobilePhone is not a string: 5.5555555555e+10"
  },
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "laptop"
  },
  "agent": {
    "ephemeral_id": "c555ca4d-f5fd-48b3-b576-8ec6c875c6a3",
    "id": "edc593f4-2c3c-4d6a-b2dc-c10b6a80fbf0",
    "name": "laptop",
    "type": "filebeat",
    "version": "9.3.0"
  },
  "okta": {
    "profile": {
      "mobilePhone": 5.5555555555e+10
    }
  },
  "input": {
    "type": "cel"
  }
}

Related issues

Closes [libbeat] - replace processor panics for non-string values #42308

The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes elastic#42308

github-actions · 2025-10-09T16:47:29Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2025-10-09T18:32:37Z

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

libbeat/processors/actions/replace.go

AndersonQ · 2025-10-10T09:32:05Z

I left just a suggestion, feel free to take it or not.

Co-authored-by: Anderson Queiroz <me@andersonq.me>

rdner · 2025-10-10T11:33:52Z

This documentation change broke the CI checks, I'm currently figuring this out.

github-actions · 2025-10-10T14:05:10Z

@Mergifyio backport 8.18 8.19 9.0 9.1 9.2

mergify · 2025-10-10T14:05:23Z

backport 8.18 8.19 9.0 9.1 9.2

✅ Backports have been created

Details

#47028 [8.18](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values has been created for branch 8.18
#47029 [8.19](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values has been created for branch 8.19
#47030 [9.0](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values has been created for branch 9.0
#47032 [9.1](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values has been created for branch 9.1
#47031 [9.2](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values has been created for branch 9.2

#47009) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes #42308 --------- Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co> (cherry picked from commit 98d1d48)

#47009) (#47032) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes #42308 --------- (cherry picked from commit 98d1d48) Co-authored-by: Orestis Floros <orestis.floros@elastic.co> Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co>

#47009) (#47031) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes #42308 --------- (cherry picked from commit 98d1d48) Co-authored-by: Orestis Floros <orestis.floros@elastic.co> Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co>

#47009) (#47030) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes #42308 --------- (cherry picked from commit 98d1d48) Co-authored-by: Orestis Floros <orestis.floros@elastic.co> Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co>

#47009) (#47028) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes #42308 --------- (cherry picked from commit 98d1d48) Co-authored-by: Orestis Floros <orestis.floros@elastic.co> Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co>

#47009) (#47029) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes #42308 --------- (cherry picked from commit 98d1d48) Co-authored-by: Orestis Floros <orestis.floros@elastic.co> Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co> Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>

elastic#47009) The replace processor would panic with an interface conversion error if it attempted to process a field that contained a non-string value (e.g., nil, integer, float). This commit adds a type check to safely validate that the field's value is a string before attempting the replacement operation. If the value is not a string, the processor will now return an error instead of panicking, making the processor more robust against malformed or unexpected data types. Closes elastic#42308 --------- Co-authored-by: Anderson Queiroz <me@andersonq.me> Co-authored-by: Denis <denis.rechkunov@elastic.co>

orestisfl self-assigned this Oct 9, 2025

orestisfl added bug backport-active-all Automated backport with mergify to all the active branches labels Oct 9, 2025

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Oct 9, 2025

orestisfl added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label Oct 9, 2025

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Oct 9, 2025

orestisfl removed the needs_team Indicates that the issue/PR needs a Team:* label label Oct 9, 2025

orestisfl marked this pull request as ready for review October 9, 2025 18:32

orestisfl requested a review from a team as a code owner October 9, 2025 18:32

orestisfl requested review from AndersonQ and khushijain21 October 9, 2025 18:32

AndersonQ approved these changes Oct 10, 2025

View reviewed changes

libbeat/processors/actions/replace.go Outdated Show resolved Hide resolved

khushijain21 approved these changes Oct 10, 2025

View reviewed changes

orestisfl and others added 3 commits October 10, 2025 12:31

Merge branch 'main' into fix-replace-processor-panic

e74f4ce

Update libbeat/processors/actions/replace.go

d0fe5be

Co-authored-by: Anderson Queiroz <me@andersonq.me>

fix test

2130fba

orestisfl enabled auto-merge (squash) October 10, 2025 10:36

rdner approved these changes Oct 10, 2025

View reviewed changes

rdner disabled auto-merge October 10, 2025 11:26

Merge branch 'main' into fix-replace-processor-panic

9becfb0

rdner enabled auto-merge (squash) October 10, 2025 12:21

rdner merged commit 98d1d48 into elastic:main Oct 10, 2025
211 checks passed

This was referenced Oct 10, 2025

[9.2](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values #47031

Merged

[9.1](backport #47009) fix(libbeat): Prevent panic in replace processor for non-string values #47032

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(libbeat): Prevent panic in replace processor for non-string values#47009

fix(libbeat): Prevent panic in replace processor for non-string values#47009
rdner merged 5 commits intoelastic:mainfrom
orestisfl:fix-replace-processor-panic

orestisfl commented Oct 9, 2025 •

edited

Loading

github-actions bot commented Oct 9, 2025

elasticmachine commented Oct 9, 2025

Uh oh!

AndersonQ commented Oct 10, 2025 •

edited

Loading

rdner commented Oct 10, 2025

Uh oh!

github-actions bot commented Oct 10, 2025

mergify bot commented Oct 10, 2025 •

edited

Loading

Labels

5 participants

Conversation

orestisfl commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Disruptive User Impact

How to test this PR locally

Related issues

github-actions bot commented Oct 9, 2025

🤖 GitHub comments

elasticmachine commented Oct 9, 2025

Uh oh!

AndersonQ commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

rdner commented Oct 10, 2025

Uh oh!

github-actions bot commented Oct 10, 2025

mergify bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Backports have been created

Labels

5 participants

orestisfl commented Oct 9, 2025 •

edited

Loading

AndersonQ commented Oct 10, 2025 •

edited

Loading

mergify bot commented Oct 10, 2025 •

edited

Loading