From bcd6ac47f773bfb992d4c45cd6980d1a2ddb58e8 Mon Sep 17 00:00:00 2001
From: Raj Kamal Singh <1133322+raj-k-singh@users.noreply.github.com>
Date: Thu, 28 Dec 2023 11:03:31 +0530
Subject: [PATCH] Fix: Logs: Pipelines: add nil check for grok parser parseFrom
 field in generated collector config (#4286)

* chore: add test validating grok parser doesn't spam logs if parse from is missing

* chore: add nil check for grok parser parseFrom
---
 .../app/logparsingpipeline/pipelineBuilder.go       |  9 +++++++++
 .../app/logparsingpipeline/pipelineBuilder_test.go  | 13 ++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/pkg/query-service/app/logparsingpipeline/pipelineBuilder.go b/pkg/query-service/app/logparsingpipeline/pipelineBuilder.go
index 29fa4cd3f8..aebe4e3890 100644
--- a/pkg/query-service/app/logparsingpipeline/pipelineBuilder.go
+++ b/pkg/query-service/app/logparsingpipeline/pipelineBuilder.go
@@ -101,6 +101,15 @@ func getOperators(ops []PipelineOperator) ([]PipelineOperator, error) {
 					),
 				)
 
+			} else if operator.Type == "grok_parser" {
+				parseFromNotNilCheck, err := fieldNotNilCheck(operator.ParseFrom)
+				if err != nil {
+					return nil, fmt.Errorf(
+						"couldn't generate nil check for parseFrom of grok op %s: %w", operator.Name, err,
+					)
+				}
+				operator.If = parseFromNotNilCheck
+
 			} else if operator.Type == "json_parser" {
 				parseFromNotNilCheck, err := fieldNotNilCheck(operator.ParseFrom)
 				if err != nil {
diff --git a/pkg/query-service/app/logparsingpipeline/pipelineBuilder_test.go b/pkg/query-service/app/logparsingpipeline/pipelineBuilder_test.go
index 222eb4f9e0..47c340b9e3 100644
--- a/pkg/query-service/app/logparsingpipeline/pipelineBuilder_test.go
+++ b/pkg/query-service/app/logparsingpipeline/pipelineBuilder_test.go
@@ -386,8 +386,19 @@ func TestNoCollectorErrorsFromProcessorsForMismatchedLogs(t *testing.T) {
 			makeTestLog("mismatching log", map[string]string{
 				"test_timestamp": "not-an-epoch",
 			}),
+		}, {
+			"grok parser should ignore logs with missing parse from field",
+			PipelineOperator{
+				ID:        "grok",
+				Type:      "grok_parser",
+				Enabled:   true,
+				Name:      "grok parser",
+				ParseFrom: "attributes.test",
+				Pattern:   "%{GREEDYDATA}",
+				ParseTo:   "attributes.test_parsed",
+			},
+			makeTestLog("test log with missing parse from field", map[string]string{}),
 		},
-		// TODO(Raj): see if there is an error scenario for grok parser.
 		// TODO(Raj): see if there is an error scenario for trace parser.
 		// TODO(Raj): see if there is an error scenario for Add operator.
 	}