Github user mattf-horton commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/308#discussion_r83462598
--- Diff:
metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/GrokParser.java
---
@@ -150,8 +149,8 @@ public void init() {
if (message.size() == 0)
throw new RuntimeException("Grok statement produced a null
message. Original message was: "
- + originalMessage + " and the parsed message was: " +
message + " . Check the pattern at: "
- + grokPath);
+ + originalMessage + " , parsed message was: " + message +
" , pattern was: "
+ + grokPattern);
--- End diff --
Instead of "+ grokPattern", would you consider:
+ (LOG.isDebugEnabled() ? grokPattern : (patternLabel + " (Turn on DEBUG
logging to see pattern text.)"))
But if you think it's really important to log the full pattern regardless
of DEBUG setting, I can accept that. It's just that under load in the field
you might run 100,000's of messages through a faulty grokPattern before
realizing the error, and blow out your log storage. Which irritates users :-)
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
