elasticsearch/logstash — pull request #1209 by driskell (2014-03-27 14:30:01+00:00)
Title: Fix multiline filter bug caused by get/set broken after overwrite() is called for an event

The arrays happening in @timestamp and causing crashes/failures/problems when using multiline filter is caused by the user of Event::overwrite()

Calling Event::overwrite() overwrites the local @data reference to point to the new data, but it did not update the reference inside @accessors. This meant that all gets to the Event returned the OLD data from before the overwrite, and sets updated the old data the gets returned too.

The problem manifests when sprintf is called - as this uses the local @data object, which would be the new data. However, when using multiline filter this will have a @timestamp array and trigger the bug. The multiline filter was meant to remove this array but it used the get/set and thus worked on the OLD data and was unable to fix up the @data referenced by sprintf()

The issue begun when the @accessors was added, 14-03-2014, and the first release this appeared in is (I think) v1.4.0 release. So it was not present in rc1.

Commit: 6796736defb74c551a6acf05787753c2cffe51ef [6796736]
Parents: ef5af78893
Date: 12 March 2014 16.54.57 GMT
Commit Date: 14 March 2014 18.55.25 GMT
Fieldreference replacement