From 1ab2035ee885cc7a801b1d6cf69ef999f464e4a1 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Wed, 19 Jun 2024 14:09:27 +0930 Subject: [PATCH] x-pack/filebeat/input/cel: fix handling of infinite values in rates The protobuf.Value.AsInterface method encodes +Inf as "Infinity" so ensure that we accept that string. --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/input/cel/input.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 372b8e352448..4de705f1d78a 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -277,6 +277,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Add support for base64-encoded HMAC headers to HTTP Endpoint. {pull}39655[39655] - Add user group membership support to Okta entity analytics provider. {issue}39814[39814] {pull}39815[39815] - Add request trace support for Okta and EntraID entity analytics providers. {pull}39821[39821] +- Fix handling of infinite rate values in CEL rate limit handling logic. {pull}[] *Auditbeat* diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go index c70941a25a53..b1750ba639dc 100644 --- a/x-pack/filebeat/input/cel/input.go +++ b/x-pack/filebeat/input/cel/input.go @@ -706,7 +706,7 @@ func getLimit(which string, rateLimit map[string]interface{}, log *logp.Logger) case float64: limit = rate.Limit(r) case string: - if !strings.EqualFold(r, "inf") { + if !strings.EqualFold(strings.TrimPrefix(r, "+"), "inf") && !strings.EqualFold(strings.TrimPrefix(r, "+"), "infinity") { log.Errorw("unexpected value returned for rate limit "+which, "value", r, "rate_limit", mapstr.M(rateLimit)) return limit, false }