{"action":"closed","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/2956","labels_url":"https://api.github.com/repos/elastic/logstash/issues/2956/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/2956/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/2956/events","html_url":"https://github.com/elastic/logstash/issues/2956","id":66938754,"number":2956,"title":"Incorrect alert firing with HipChat output due to number of digits in source field","user":{"login":"deepybee","id":5628465,"avatar_url":"https://avatars.githubusercontent.com/u/5628465?v=3","gravatar_id":"","url":"https://api.github.com/users/deepybee","html_url":"https://github.com/deepybee","followers_url":"https://api.github.com/users/deepybee/followers","following_url":"https://api.github.com/users/deepybee/following{/other_user}","gists_url":"https://api.github.com/users/deepybee/gists{/gist_id}","starred_url":"https://api.github.com/users/deepybee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deepybee/subscriptions","organizations_url":"https://api.github.com/users/deepybee/orgs","repos_url":"https://api.github.com/users/deepybee/repos","events_url":"https://api.github.com/users/deepybee/events{/privacy}","received_events_url":"https://api.github.com/users/deepybee/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-04-07T17:04:51Z","updated_at":"2015-04-07T23:57:57Z","closed_at":"2015-04-07T23:57:57Z","body":"I've got a weird issue where depending on the number of characters in a numeric field Logstash 1.4.2-1-2c0f5a1 will or won't throw an error.\r\n\r\nFirst, the error message (this may be a red herring, but for posterity I'll list it here):\r\n\r\n\"WARNING: unimplemented method called: StoreContext#error_depth\"\r\n\r\nHaving trawled previous issues this is a JRuby flaw relating to their implementation of OpenSSL, as reported in #1612 and before that on https://logstash.jira.com/browse/LOGSTASH-1428.\r\n\r\nThe issue I am seeing manifests itself thus: I have an inbound message for OpenMQ stats, which grok splits out into several fields, including one containing the current number of queued messages. Based on this field's value, Logstash is configured to fire notifications to HipChat as red, yellow or green. For reference, these thresholds are set at < 20000 (green), >= 20000 and <= 50000 (yellow), finally > 50000 (red).\r\n\r\nThe problem is that Logstash appears to expect a 5 digit integer for all values in this field and treats the data as the leading characters of a 5 digit integer, which the source data does not write unless the value genuinely warrants a 5 digit integer; ie the value 65 is treated as 65000 and so fires the critical red alert which it should return green as it is under 20000, 499 is treated as 49900 and fires the yellow alert etc.\r\n\r\nIs this expected behaviour? I can write a mutate filter to address this and insert leading zeroes but I can't fathom why this current behaviour is as it is.\r\n\r\nAm I missing something blindingly obvious here or is this a bug?"}}