iter2

Author: martijnvg

docs/reference/ingest/ingest-node.asciidoc

@@ -1515,9 +1515,9 @@ This can be useful to reference as the built-in patterns change across versions.
 [[grok-watchdog]]
 ==== Grok watchdog
 
-Grok expression that take too long to execute are interrupted and
-the the grok processor then fails with an exception. The grok
-processor has a watchdog thread that determines when evaluation
+Grok expressions that take too long to execute are interrupted and
+the grok processor then fails with an exception. The grok
+processor has a watchdog thread that determines when evaluation of
 a grok expression takes too long and is controlled by the following
 settings:
 

libs/grok/src/main/java/org/elasticsearch/grok/Grok.java

@@ -249,7 +249,7 @@ public Map<String, Object> captures(String text) {
             threadWatchdog.unregister();
         }
         if (result == Matcher.INTERRUPTED) {
-            throw new IllegalArgumentException("grok pattern matching was interrupted after [" +
+            throw new RuntimeException("grok pattern matching was interrupted after [" +
                 threadWatchdog.maxExecutionTime() + "] ms");
         } else if (result == Matcher.FAILED) {
             // TODO: I think we should throw an error here?

libs/grok/src/test/java/org/elasticsearch/grok/GrokTests.java

@@ -435,7 +435,7 @@ public void testExponentialExpressions() {
             return null;
         };
         Grok grok = new Grok(basePatterns, grokPattern, ThreadWatchdog.newInstance(10, 200, System::currentTimeMillis, scheduler));
-        Exception e = expectThrows(IllegalArgumentException.class, () -> grok.captures(logLine));
+        Exception e = expectThrows(RuntimeException.class, () -> grok.captures(logLine));
         run.set(false);
         assertThat(e.getMessage(), equalTo("grok pattern matching was interrupted after [200] ms"));
     }