Skip CEF fields that carry an empty numeric value

[fpetersen-gl]

Description

Numeric CEF converters now return null for a blank value instead of throwing. MappedMessage
skips a field whose converted value is null and logs it at trace level.

A value that is malformed rather than empty still logs a warning. That warning now names the
offending value and omits the stack trace, which was identical every time.

Empty string and unmapped fields are untouched. They still store an empty value, so existing
has_field() and _exists_ searches behave as before.

Motivation and Context

A SecureAuth appliance sends an empty cfp1 on nearly every message. Each one produced a
NumberFormatException with a full stack trace at WARN:

WARN [MappedMessage] Could not transform CEF field [cfp1] according to standard. Skipping.
java.lang.NumberFormatException: empty String
    at org.graylog.plugins.cef.parser.CEFMapping.convertFloat(CEFMapping.java:232)
    at org.graylog.plugins.cef.parser.MappedMessage.mapExtensions(MappedMessage.java:52)

The field was already dropped, so only the logging was wrong. The CEF input and parse_cef()
both construct MappedMessage, so moving CEF parsing into a pipeline was no workaround. The
only remedy was silencing org.graylog.plugins.cef, which also hid genuine CEF errors.

This affects every numerically typed CEF field, not just cfp1. MappedMessage has had no
functional change since the plugin was merged into core, so all 7.0.x and 7.1.x releases behave
the same way. Reported on 7.0.5.

Fixes #26833.

How Has This Been Tested?

New MappedMessageTest covers all five numeric converters, the malformed-value warning, and the
unchanged handling of empty string, unmapped, and labelled fields.

./mvnw -pl :graylog2-server test -Dtest='MappedMessageTest,CEFMappingTest,CEFCodecTest,\
CEFCodecFixturesTest,CEFParserFunctionTest,CEFTimestampParserTest'

Reverting the two production files makes three of the new tests fail, which confirms they pin the
change rather than the behaviour that was already correct:

• emptyNumericValueIsNotLoggedAsAWarning
• emptyValueIsSkippedForEveryNumericType
• malformedNumericValueIsLoggedWithoutAStackTrace

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have requested a documentation update.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[Copilot]

Pull request overview

This PR reduces log noise from Common Event Format (CEF) parsing by treating blank values in numerically-typed CEF extensions as “absent” rather than as conversion errors, while keeping malformed (non-empty) numeric values diagnosable without flooding logs.

Changes:

• Update numeric CEF converters to return null for blank/whitespace values instead of throwing during parsing.
• Update MappedMessage to skip mapped fields whose converted value is null, and to stop attaching stack traces to conversion warnings.
• Add MappedMessageTest coverage for empty/malformed numeric values and for unchanged behavior of empty string + unmapped fields.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
graylog2-server/src/test/java/org/graylog/plugins/cef/parser/MappedMessageTest.java	Adds tests asserting empty numeric values are skipped quietly, malformed values warn without throwable, and string/unmapped empty values remain retained.
graylog2-server/src/main/java/org/graylog/plugins/cef/parser/MappedMessage.java	Skips mapped fields when conversion returns null and adjusts logging to reduce noisy stack traces.
graylog2-server/src/main/java/org/graylog/plugins/cef/parser/CEFMapping.java	Makes numeric converters return null for blank inputs and annotates conversion methods as nullable.
changelog/unreleased/issue-26833.toml	Adds an unreleased changelog entry for the fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.