ECS-Compatiblity mode GeoIP Filter configuration syntax in logstash.conf map prevents "Logstash with ECK" recipe from starting up a Logstash pod

[gkuzmanov]

Bug Report

What did you do?

Adjusted the Logstash recipe at https://github.com/elastic/cloud-on-k8s/tree/main/config/recipes/logstash and deployed it alongside my own Elastic stack managed by ECK 2.5 under OpenShift 4.10 on AWS. I renamed the references within the recipe YAML to refer to objects in my Elastic stack.

What did you expect to see?

I expected the Logstash Deployment to start at least one Logstash pod

What did you see instead? Under which circumstances?

Logstash shuts down having failed to start up its pipeline due to the following entry in the example logstash.conf from the recipe:

      geoip {
        source => "clientip"
      }

Environment

• ECK version:

  2.5

• Kubernetes information:

  Self-managed Openshift 4.10 on AWS VMs

$ kubectl version

Client Version: 4.10.0-202204291519.p0.g09f825e.assembly.stream-09f825e
Kubernetes Version: v1.23.5+012e945

• Logs:

[ERROR] 2022-12-22 12:01:11.917 [[main]-pipeline-manager] javapipeline - Pipeline error {:pipeline_id=>"main", :exception=>#<LogStash::ConfigurationError: GeoIP Filter in ECS-Compatiblity mode requires a `target` when `source` is not an `ip` sub-field, eg. [client][ip]>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/logstash-filter-geoip-7.2.12-java/lib/logstash/filters/geoip.rb:143:in `auto_target_from_source!'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/logstash-filter-geoip-7.2.12-java/lib/logstash/filters/geoip.rb:133:in `setup_target_field'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/logstash-filter-geoip-7.2.12-java/lib/logstash/filters/geoip.rb:108:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:234:in `block in register_plugins'", "org/jruby/RubyArray.java:1865:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:233:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:601:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:246:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:191:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:143:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x2cdfda36@/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:131 run>"}
[INFO ] 2022-12-22 12:01:11.918 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}
[ERROR] 2022-12-22 12:01:11.932 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[INFO ] 2022-12-22 12:01:11.941 [LogStash::Runner] runner - Logstash shut down.

[barkbay]

Closed by #6333