Parser validation random responses??

[Tonio]

Hello everyone,

I am in the process of finalizing a parser, trying to debug the validation errors I recive when adding the

mutate {merge => {"@output" => session "event"}} 

Here I encountered a strange behavior of the response: it keeps changing, even though the code and the test log are the same. In a nutshell, if I repeatedly press the "Preview" button in the UI, without any changes to code/log, the validation result keeps changing.

I noticed that, for how the code is now, there are 5 or 6 error messages and they seem to be chosen randomly each time. This makes debugging rather difficult.

Update:
After several investigations and after resolving the different errors, I was able to fix all the problems. Still, I am concerned: is this a normal behavior? Shouldn't the same code always produce the same error? Until the very end I had no way to see if the next error will be produced by my latest fixes or by a pre-existing error...

Cheers,

Antonio

[citreno]

One quick thing to be mindful of, the parser testing UI seems to have some weird caching, i.e. you may be running preview on the previous log you tested even though it shows a new log. For sanity (or insanity) purposes I always hit edit and save once or twice.  In terms of inconsistencies in the errors with the same log, it's hard to tell without examples but the only time I've personally seen this is where you have a long sequence of statements in a rename or merge. For some reason renames don't run sequentially the order can be arbitrary. same with merges I think. I highly recommend keeping merges in a separate statement with their own on_error => "_" in each.