VM attempts to parse IP addr as float

[zane-deg]

Summary

Certain regex patterns when used to capture an IP address are causing mtail to try and parse IP addresses as a float:

Runtime error: strconv.ParseFloat: parsing "10.0.0.1": invalid syntax

I have included an mtail program below that can recreate the problem along with a similar program that does not cause the problem. Curiously this seems to only occur when creating a histogram metric.

Steps to reproduce:

1. mtail --one_shot --progs broken.mtail --logs example.log -logtostderr
2. Verify Runtime error occurs
3. mtail --one_shot --progs working.mtail --logs example.log -logtostderr
4. Verify program runs as expected

mtail --version

mtail version 3.0.0-rc47 git revision 5e0099f843e4e4f2b7189c21019de18eb49181bf go version go1.16.5 go arch amd64 go os darwin

AST Type Dump

I have attempted to get a type dump by running:

• mtail --one_shot --progs broken.mtail --logs example.log --dump_ast_types --log_dir output
• mtail --one_shot --compile_only --progs broken.mtail --logs example.log --dump_ast_types --log_dir output

Neither has resulted in a log beyond:

Log file created at: 2021/09/28 15:20:02
Running on machine: MY_MACHINE_NAME
Binary: Built with gc go1.16.5 for darwin/amd64
Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg

Let me know if I am running this command incorrectly and I can submit the appropriate log.

Thanks!

---

example.log

10.0.0.1 total_time=5
10.0.0.2 total_time=742

broken.mtail

histogram example_name buckets 1, 2 by instance

/^(?P<ip>[\d\.]+) total_time=(?P<total>\d+)/ {
  example_name[$ip] = $total / 1000.0
}

working.mtail

histogram example_name buckets 1, 2 by instance

/^(?P<ip>\d+(?:\.\d+){3}) total_time=(?P<total>\d+)/ {
  example_name[$ip] = $total / 1000.0
}

[jaqx0r]

Thankyou for the detailed report and reproduction steps!

I think the bug is that mtail looks at the possible content of the IP in broken.mtail and infers that it could be a float, but doesn't note that there can only be a single decimal point in it, while the field accepts more than one. The second form makes the repetition explicit, so it's partially working in that it can tell that there's more than one decimal point matched in working.mtail.

[milad-zanganeh]

I'm wondering why it's still open after 4 years!