merge 8.x into feature branch... (#16519)

* Add GH vault plugin bot to allowed list (#16301) * regenerate webserver test certificates (#16331) * correctly handle stack overflow errors during pipeline compilation (#16323) This commit improves error handling when pipelines that are too big hit the Xss limit and throw a StackOverflowError. Currently the exception is printed outside of the logger, and doesn’t even show if log.format is json, leaving the user to wonder what happened. A couple of thoughts on the way this is implemented: * There should be a first barrier to handle pipelines that are too large based on the PipelineIR compilation. The barrier would use the detection of Xss to determine how big a pipeline could be. This however doesn't reduce the need to still handle a StackOverflow if it happens. * The catching of StackOverflowError could also be done on the WorkerLoop. However I'd suggest that this is unrelated to the Worker initialization itself, it just so happens that compiledPipeline.buildExecution is computed inside the WorkerLoop class for performance reasons. So I'd prefer logging to not come from the existing catch, but from a dedicated catch clause. Solves #16320 * Doc: Reposition worker-utilization in doc (#16335) * settings: add support for observing settings after post-process hooks (#16339) Because logging configuration occurs after loading the `logstash.yml` settings, deprecation logs from `LogStash::Settings::DeprecatedAlias#set` are effectively emitted to a null logger and lost. By re-emitting after the post-process hooks, we can ensure that they make their way to the deprecation log. This change adds support for any setting that responds to `Object#observe_post_process` to receive it after all post-processing hooks have been executed. Resolves: #16332 * fix line used to determine ES is up (#16349) * add retries to snyk buildkite job (#16343) * Fix 8.13.1 release notes (#16363) make a note of the fix that went to 8.13.1: #16026 Co-authored-by: Karen Metts <[email protected]> * Update logstash_releases.json (#16347) * [Bugfix] Resolve the array and char (single | double quote) escaped values of ${ENV} (#16365) * Properly resolve the values from ENV vars if literal array string provided with ENV var. * Docker acceptance test for persisting keys and use actual values in docker container. * Review suggestion. Simplify the code by stripping whitespace before `gsub`, no need to check comma and split. Co-authored-by: João Duarte <[email protected]> --------- Co-authored-by: João Duarte <[email protected]> * Doc: Add SNMP integration to breaking changes (#16374) * deprecate java less-than 17 (#16370) * Exclude substitution refinement on pipelines.yml (#16375) * Exclude substitution refinement on pipelines.yml (applies on ENV vars and logstash.yml where env2yaml saves vars) * Safety integration test for pipeline config.string contains ENV . * Doc: Forwardport 8.15.0 release notes to main (#16388) * Removing 8.14 from ci/branches.json as we have 8.15. (#16390) * Increase Jruby -Xmx to avoid OOM during zip task in DRA (#16408) Fix: #16406 * Generate Dataset code with meaningful fields names (#16386) This PR is intended to help Logstash developers or users that want to better understand the code that's autogenerated to model a pipeline, assigning more meaningful names to the Datasets subclasses' fields. Updates `FieldDefinition` to receive the name of the field from construction methods, so that it can be used during the code generation phase, instead of the existing incremental `field%n`. Updates `ClassFields` to propagate the explicit field name down to the `FieldDefinitions`. Update the `DatasetCompiler` that add fields to `ClassFields` to assign a proper name to generated Dataset's fields. * Implements safe evaluation of conditional expressions, logging the error without killing the pipeline (#16322) This PR protects the if statements against expression evaluation errors, cancel the event under processing and log it. This avoids to crash the pipeline which encounter a runtime error during event condition evaluation, permitting to debug the root cause reporting the offending event and removing from the current processing batch. Translates the `org.jruby.exceptions.TypeError`, `IllegalArgumentException`, `org.jruby.exceptions.ArgumentError` that could happen during `EventCodition` evaluation into a custom `ConditionalEvaluationError` which bubbles up on AST tree nodes. It's catched in the `SplitDataset` node. Updates the generation of the `SplitDataset `so that the execution of `filterEvents` method inside the compute body is try-catch guarded and defer the execution to an instance of `AbstractPipelineExt.ConditionalEvaluationListener` to handle such error. In this particular case the error management consist in just logging the offending Event. --------- Co-authored-by: Karen Metts <[email protected]> * Update logstash_releases.json (#16426) * Release notes for 8.15.1 (#16405) (#16427) * Update release notes for 8.15.1 * update release note --------- Co-authored-by: logstashmachine <[email protected]> Co-authored-by: Kaise Cheng <[email protected]> (cherry picked from commit 2fca7e3) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Fix ConditionalEvaluationError to do not include the event that errored in its serialiaxed form, because it's not expected that this class is ever serialized. (#16429) (#16430) Make inner field of ConditionalEvaluationError transient to be avoided during serialization. (cherry picked from commit bb7ecc2) Co-authored-by: Andrea Selva <[email protected]> * use gnu tar compatible minitar to generate tar artifact (#16432) (#16434) Using VERSION_QUALIFIER when building the tarball distribution will fail since Ruby's TarWriter implements the older POSIX88 version of tar and paths will be longer than 100 characters. For the long paths being used in Logstash's plugins, mainly due to nested folders from jar-dependencies, we need the tarball to follow either the 2001 ustar format or gnu tar, which is implemented by the minitar gem. (cherry picked from commit 69f0fa5) Co-authored-by: João Duarte <[email protected]> * account for the 8.x in DRA publishing task (#16436) (#16440) the current DRA publishing task computes the branch from the version contained in the version.yml This is done by taking the major.minor and confirming that a branch exists with that name. However this pattern won't be applicable for 8.x, as that branch currently points to 8.16.0 and there is no 8.16 branch. This commit falls back to reading the buildkite injected BUILDKITE_BRANCH variable. (cherry picked from commit 17dba9f) Co-authored-by: João Duarte <[email protected]> * Fixes the issue where LS wipes out all quotes from docker env variables. (#16456) (#16459) * Fixes the issue where LS wipes out all quotes from docker env variables. This is an issue when running LS on docker with CONFIG_STRING, needs to keep quotes with env variable. * Add a docker acceptance integration test. (cherry picked from commit 7c64c73) Co-authored-by: Mashhur <[email protected]> * Known issue for 8.15.1 related to env vars references (#16455) (#16469) (cherry picked from commit b54caf3) Co-authored-by: Luca Belluccini <[email protected]> * bump .ruby_version to jruby-9.4.8.0 (#16477) (#16480) (cherry picked from commit 51cca73) Co-authored-by: João Duarte <[email protected]> * Release notes for 8.15.2 (#16471) (#16478) Co-authored-by: andsel <[email protected]> Co-authored-by: Karen Metts <[email protected]> (cherry picked from commit 01dc76f) * Change LogStash::Util::SubstitutionVariables#replace_placeholders refine argument to optional (#16485) (#16488) (cherry picked from commit 8368c00) Co-authored-by: Edmo Vamerlatti Costa <[email protected]> * Use jruby-9.4.8.0 in exhaustive CIs. (#16489) (#16491) (cherry picked from commit fd1de39) Co-authored-by: Mashhur <[email protected]> * Don't use an older JRuby with oraclelinux-7 (#16499) (#16501) A recent PR (elastic/ci-agent-images/pull/932) modernized the VM images and removed JRuby 9.4.5.0 and some older versions. This ended up breaking exhaustive test on Oracle Linux 7 that hard coded JRuby 9.4.5.0. PR #16489 worked around the problem by pinning to the new JRuby, but actually we don't need the conditional anymore since the original issue jruby/jruby#7579 (comment) has been resolved and none of our releasable branches (apart from 7.17 which uses `9.2.20.1`) specify `9.3.x.y` in `/.ruby-version`. Therefore, this commit removes conditional setting of JRuby for OracleLinux 7 agents in exhaustive tests (and relies on whatever `/.ruby-version` defines). (cherry picked from commit 07c01f8) Co-authored-by: Dimitrios Liappis <[email protected]> * Improve pipeline bootstrap error logs (#16495) (#16504) This PR adds the cause errors details on the pipeline converge state error logs (cherry picked from commit e84fb45) Co-authored-by: Edmo Vamerlatti Costa <[email protected]> * Logstash Health Report Tests Buildkite pipeline setup. (#16416) (#16511) (cherry picked from commit 5195332) Co-authored-by: Mashhur <[email protected]> * Make health report test runner script executable. (#16446) (#16512) (cherry picked from commit 2ebf265) Co-authored-by: Mashhur <[email protected]> * Backport PR #16423 to 8.x: DLQ-ing events that trigger an conditional evaluation error. (#16493) * DLQ-ing events that trigger an conditional evaluation error. (#16423) When a conditional evaluation encounter an error in the expression the event that triggered the issue is sent to pipeline's DLQ, if enabled for the executing pipeline. This PR engage with the work done in #16322, the `ConditionalEvaluationListener` that is receives notifications about if-statements evaluation failure, is improved to also send the event to DLQ (if enabled in the pipeline) and not just logging it. (cherry picked from commit b69d993) * Fixed warning about non serializable field DeadLetterQueueWriter in serializable AbstractPipelineExt --------- Co-authored-by: Andrea Selva <[email protected]> * add deprecation log for `--event_api.tags.illegal` (#16507) (#16515) - move `--event_api.tags.illegal` from option to deprecated_option - add deprecation log when the flag is explicitly used relates: #16356 Co-authored-by: Mashhur <[email protected]> (cherry picked from commit a4eddb8) Co-authored-by: kaisecheng <[email protected]> --------- Co-authored-by: ev1yehor <[email protected]> Co-authored-by: João Duarte <[email protected]> Co-authored-by: Karen Metts <[email protected]> Co-authored-by: Andrea Selva <[email protected]> Co-authored-by: Mashhur <[email protected]> Co-authored-by: kaisecheng <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Luca Belluccini <[email protected]> Co-authored-by: Edmo Vamerlatti Costa <[email protected]> Co-authored-by: Dimitrios Liappis <[email protected]>
elastic · Oct 8, 2024 · b1d3c5d · b1d3c5d
1 parent a13d251
commit b1d3c5d
Show file tree

Hide file tree

Showing 11 changed files with 201 additions and 20 deletions.
diff --git a/.buildkite/health_report_tests_pipeline.yml b/.buildkite/health_report_tests_pipeline.yml
@@ -0,0 +1,17 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+
+agents:
+  image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-logstash-ci"
+  cpu: "2"
+  memory: "4Gi"
+  ephemeralStorage: "64Gi"
+
+steps:
+  # todo: add a step for 8.latest when Health Report MVP is landed
+  - label: ":logstash: Health Report Integration tests on main branch."
+    command: |
+      source .buildkite/scripts/common/vm-agent.sh
+      ./.buildkite/scripts/health-report-tests/main.sh
+    retry:
+      automatic:
+        - limit: 3
diff --git a/.buildkite/scripts/health-report-tests/main.sh b/.buildkite/scripts/health-report-tests/main.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 set -eo pipefail
 
-# Install prerequisites and run integration tests
 python3 -mpip install -r .buildkite/scripts/health-report-tests/requirements.txt
-python3 .buildkite/scripts/health-report-tests/main.py
+python3 .buildkite/scripts/health-report-tests/main.py
diff --git a/catalog-info.yaml b/catalog-info.yaml
@@ -32,6 +32,7 @@ spec:
     - resource:logstash-linux-jdk-matrix-pipeline
     - resource:logstash-windows-jdk-matrix-pipeline
     - resource:logstash-benchmark-pipeline
+    - resource:logstash-health-report-tests-pipeline
 
 # ***********************************
 # Declare serverless IT pipeline
@@ -642,4 +643,57 @@ spec:
 
 # *******************************
 # SECTION END: Benchmark pipeline
+# *******************************
+
+# ***********************************
+# Declare Health Report Tests pipeline
+# ***********************************
+---
+# yaml-language-server: $schema=https://gist.githubusercontent.com/elasticmachine/988b80dae436cafea07d9a4a460a011d/raw/rre.schema.json
+apiVersion: backstage.io/v1alpha1
+kind: Resource
+metadata:
+  name: logstash-health-report-tests-pipeline
+  description: Buildkite pipeline for the Logstash Health Report Tests
+  links:
+    - title: ':logstash Logstash Health Report Tests (Daily, Auto) pipeline'
+      url: https://buildkite.com/elastic/logstash-health-report-tests-pipeline
+spec:
+  type: buildkite-pipeline
+  owner: group:logstash
+  system: platform-ingest
+  implementation:
+    apiVersion: buildkite.elastic.dev/v1
+    kind: Pipeline
+    metadata:
+      name: logstash-health-report-tests-pipeline
+      description: ':logstash: Logstash Health Report tests :pipeline:'
+    spec:
+      repository: elastic/logstash
+      pipeline_file: ".buildkite/health_report_tests_pipeline.yml"
+      maximum_timeout_in_minutes: 60
+      provider_settings:
+        trigger_mode: none # don't trigger jobs from github activity
+      env:
+        ELASTIC_SLACK_NOTIFICATIONS_ENABLED: 'true'
+        SLACK_NOTIFICATIONS_CHANNEL: '#logstash-build'
+        SLACK_NOTIFICATIONS_ON_SUCCESS: 'false'
+        SLACK_NOTIFICATIONS_SKIP_FOR_RETRIES: 'true'
+      teams:
+        ingest-fp:
+          access_level: MANAGE_BUILD_AND_READ
+        logstash:
+          access_level: MANAGE_BUILD_AND_READ
+        ingest-eng-prod:
+          access_level: MANAGE_BUILD_AND_READ
+        everyone:
+          access_level: READ_ONLY
+      schedules:
+        Daily Health Report tests on main branch:
+          branch: main
+          cronline: 30 20 * * *
+          message: Daily trigger of Health Report Tests Pipeline
+
+# *******************************
+# SECTION END: Health Report Tests pipeline
 # *******************************
diff --git a/docs/static/dead-letter-queues.asciidoc b/docs/static/dead-letter-queues.asciidoc
@@ -21,9 +21,10 @@ loss in this situation, you can <<configuring-dlq,configure Logstash>> to write
 unsuccessful events to a dead letter queue instead of dropping them.
 
 NOTE: The dead letter queue is currently supported only for the
-<<plugins-outputs-elasticsearch,{es} output>>. The dead letter queue is used for
-documents with response codes of 400 or 404, both of which indicate an event
+<<plugins-outputs-elasticsearch,{es} output>> and <<conditionals, conditional statements evaluation>>.
+The dead letter queue is used for documents with response codes of 400 or 404, both of which indicate an event
 that cannot be retried.
+It's also used when a conditional evaluation encounter an error.
 
 Each event written to the dead letter queue includes the original event,
 metadata that describes the reason the event could not be processed, information
@@ -57,7 +58,12 @@ status code per entry to indicate why the action could not be performed.
 If the DLQ is configured, individual indexing failures are routed there.
 
 Even if you regularly process events, events remain in the dead letter queue.
-The dead letter queue requires <<dlq-clear,manual intervention>> to clear it. 
+The dead letter queue requires <<dlq-clear,manual intervention>> to clear it.
+
+[[conditionals-dlq]]
+==== Conditional statements and the dead letter queue
+When a conditional statement reaches an error in processing an event, such as comparing string and integer values,
+the event, as it is at the time of evaluation, is inserted into the dead letter queue.
 
 [[configuring-dlq]]
 ==== Configuring {ls} to use dead letter queues

diff --git a/logstash-core/lib/logstash/agent.rb b/logstash-core/lib/logstash/agent.rb
@@ -425,7 +425,13 @@ def converge_state(pipeline_actions)
             )
           end
         rescue SystemExit, Exception => e
-          logger.error("Failed to execute action", :action => action, :exception => e.class.name, :message => e.message, :backtrace => e.backtrace)
+          error_details = { :action => action, :exception => e.class.name, :message => e.message, :backtrace => e.backtrace }
+          cause = e.cause
+          if cause && e != cause
+            error_details[:cause] = { :exception => cause.class, :message => cause.message }
+            error_details[:cause][:backtrace] = cause.backtrace if cause.backtrace
+          end
+          logger.error('Failed to execute action', error_details)
           converge_result.add(action, LogStash::ConvergeResult::FailedAction.from_exception(e))
         end
       end

diff --git a/logstash-core/lib/logstash/patches/clamp.rb b/logstash-core/lib/logstash/patches/clamp.rb
@@ -79,8 +79,16 @@ def define_deprecated_writer_for(option, opts, &block)
           new_flag = opts[:new_flag]
           new_value = opts.fetch(:new_value, value)
           passthrough = opts.fetch(:passthrough, false)
+          deprecated_msg = opts[:deprecated_msg]
 
-          LogStash::DeprecationMessage.instance << "DEPRECATION WARNING: The flag #{option.switches} has been deprecated, please use \"--#{new_flag}=#{new_value}\" instead."
+          LogStash::DeprecationMessage.instance <<
+            if new_flag
+             "DEPRECATION WARNING: The flag #{option.switches} has been deprecated, please use \"--#{new_flag}=#{new_value}\" instead."
+            elsif deprecated_msg
+              deprecated_msg
+            else
+              "DEPRECATION WARNING: The flag #{option.switches} has been deprecated and may be removed in a future release."
+            end
 
           if passthrough
             LogStash::SETTINGS.set(option.attribute_name, value)

diff --git a/logstash-core/lib/logstash/runner.rb b/logstash-core/lib/logstash/runner.rb
@@ -92,10 +92,6 @@ class LogStash::Runner < Clamp::StrictCommand
          :default => LogStash::SETTINGS.get_default("config.field_reference.escape_style"),
          :attribute_name => "config.field_reference.escape_style"
 
-  option ["--event_api.tags.illegal"], "STRING",
-         I18n.t("logstash.runner.flag.event_api.tags.illegal"),
-         :default => LogStash::SETTINGS.get_default("event_api.tags.illegal"),
-         :attribute_name => "event_api.tags.illegal"
 
   # Module settings
   option ["--modules"], "MODULES",
@@ -267,6 +263,12 @@ class LogStash::Runner < Clamp::StrictCommand
     I18n.t("logstash.runner.flag.http_port"),
     :new_flag => "api.http.port", :passthrough => true # use settings to disambiguate
 
+  deprecated_option ["--event_api.tags.illegal"], "STRING",
+         I18n.t("logstash.runner.flag.event_api.tags.illegal"),
+         :default => LogStash::SETTINGS.get_default("event_api.tags.illegal"),
+         :attribute_name => "event_api.tags.illegal", :passthrough => true,
+         :deprecated_msg => I18n.t("logstash.runner.tags-illegal-deprecated")
+
   # We configure the registry and load any plugin that can register hooks
   # with logstash, this needs to be done before any operation.
   SYSTEM_SETTINGS = LogStash::SETTINGS.clone

diff --git a/logstash-core/locales/en.yml b/logstash-core/locales/en.yml
@@ -139,9 +139,11 @@ en:
       configtest-flag-information: |-
         You may be interested in the '--configtest' flag which you can use to validate
         logstash's configuration before you choose to restart a running system.
+      tags-illegal-deprecated: >-
+        The flag '--event_api.tags.illegal' is deprecated and will be removed in version 9.
       tags-illegal-warning: >-
         Setting `event_api.tags.illegal` to `warn` allows illegal values in the reserved `tags` field, which may crash pipeline unexpectedly.
-        This flag value is deprecated and may be removed in a future release.
+        This flag is deprecated and will be removed in version 9.
       # YAML named reference to the logstash.runner.configuration
       # so we can later alias it from logstash.agent.configuration
       configuration: &runner_configuration

diff --git a/logstash-core/spec/logstash/java_pipeline_spec.rb b/logstash-core/spec/logstash/java_pipeline_spec.rb
@@ -443,9 +443,8 @@ def flush(options)
           LogStash::PLUGIN_REGISTRY.add(:output, "spec_sampler_output", PipelineHelpers::SpecSamplerOutput)
         end
 
-        describe "given a pipeline executing an event that would trigger an evaluation error" do
+        context "given a pipeline executing an event that would trigger an evaluation error" do
           let(:pipeline) do
-            settings.set_value("queue.drain", true)
             LogStash::JavaPipeline.new(
               org.logstash.config.ir.PipelineConfig.new(
                 LogStash::Config::Source::Local, :main,
@@ -470,11 +469,50 @@ def flush(options)
             pipeline.close
           end
 
-          subject {results.length > 1 ? results : results.first}
+          describe "when DLQ is disabled" do
+            let(:settings) do
+              s = super()
+              s.set_value("queue.drain", true)
+              s
+            end
 
-          it "should raise an error without killing the pipeline" do
-            expect(subject).to be nil
-            expect(pipeline.last_error_evaluation_received).to match(/no implicit conversion of nil into Integer/)
+            subject {results.length > 1 ? results : results.first}
+
+            it "should raise an error without killing the pipeline" do
+              expect(subject).to be nil
+              expect(pipeline.last_error_evaluation_received).to match(/no implicit conversion of nil into Integer/)
+            end
+          end
+
+          describe "when DLQ is enabled" do
+            let(:dlq_path) { Dir.mktmpdir }
+
+            let(:settings) do
+              s = super()
+              s.set_value("queue.drain", true)
+              s.set_value("pipeline.id", "test_dlq")
+              s.set_value("dead_letter_queue.enable", true)
+              s.set_value("path.dead_letter_queue", dlq_path)
+              s
+            end
+
+            after do
+              FileUtils.rm_rf(settings.get_value("path.dead_letter_queue"))
+            end
+
+            subject {results.length > 1 ? results : results.first}
+
+            it "should raise an error without killing the pipeline and insert the event into DLQ" do
+              expect(subject).to be nil
+              expect(pipeline.last_error_evaluation_received).to match(/no implicit conversion of nil into Integer/)
+              dlq_path = java.nio.file.Paths.get(settings.get_value("path.dead_letter_queue"), "test_dlq")
+              dlq_reader = org.logstash.common.io.DeadLetterQueueReader.new(dlq_path)
+              entry = dlq_reader.pollEntry(40)
+              expect(entry).to_not be_nil
+              expect(entry.reason).to match(/condition evaluation error.*no implicit conversion of nil into Integer/)
+              expect(entry.plugin_id).to eq("if-statement")
+              expect(entry.plugin_type).to eq("if-statement")
+            end
           end
         end
 

diff --git a/logstash-core/spec/logstash/runner_spec.rb b/logstash-core/spec/logstash/runner_spec.rb
@@ -380,6 +380,32 @@
       end
     end
 
+    context "event_api.tags.illegal" do
+      let(:runner_deprecation_logger_stub) { double("DeprecationLogger(Runner)").as_null_object }
+      let(:args) { ["--event_api.tags.illegal", "warn", "-e", pipeline_string] }
+      before(:each) { allow(runner).to receive(:deprecation_logger).and_return(runner_deprecation_logger_stub) }
+      DEPRECATED_MSG="The flag '--event_api.tags.illegal' is deprecated and will be removed in version 9"
+
+      it "gives deprecation message when setting to `warn`" do
+        expect(runner_deprecation_logger_stub).to receive(:deprecated)
+          .with(a_string_including "This flag is deprecated and will be removed in version 9")
+          .with(a_string_including DEPRECATED_MSG)
+        subject.run("bin/logstash", args)
+      end
+
+      it "gives deprecation message when setting to `rename`" do
+        expect(runner_deprecation_logger_stub).to receive(:deprecated)
+          .with(a_string_including DEPRECATED_MSG)
+        subject.run("bin/logstash", args)
+      end
+
+      it "does not give deprecation message when unset" do
+        expect(runner_deprecation_logger_stub).not_to receive(:deprecated)
+          .with(a_string_including DEPRECATED_MSG)
+        subject.run("bin/logstash", ["-e", pipeline_string])
+      end
+    end
+
     context "when :pipeline_workers is not defined by the user" do
       it "should not pass the value to the pipeline" do
         expect(LogStash::Agent).to receive(:new) do |settings|

diff --git a/logstash-core/src/main/java/org/logstash/execution/AbstractPipelineExt.java b/logstash-core/src/main/java/org/logstash/execution/AbstractPipelineExt.java
@@ -167,6 +167,7 @@ public class AbstractPipelineExt extends RubyBasicObject {
     private @SuppressWarnings("rawtypes") RubyArray outputs;
 
     private String lastErrorEvaluationReceived = "";
+    private transient DeadLetterQueueWriter javaDlqWriter;
 
     public AbstractPipelineExt(final Ruby runtime, final RubyClass metaClass) {
         super(runtime, metaClass);
@@ -180,10 +181,32 @@ public final class LogErrorEvaluationListener implements ConditionalEvaluationLi
         @Override
         public void notify(ConditionalEvaluationError err) {
             lastErrorEvaluationReceived = err.getCause().getMessage();
-            LOGGER.warn("{}. Event was dropped, enable debug logging to see the event's payload.", lastErrorEvaluationReceived);
+            if (isDLQEnabled()) {
+                LOGGER.warn("{}. Failing event was sent to dead letter queue", lastErrorEvaluationReceived);
+            } else {
+                LOGGER.warn("{}. Event was dropped, enable debug logging to see the event's payload", lastErrorEvaluationReceived);
+            }
             LOGGER.debug("Event generating the fault: {}", err.failedEvent().toMap().toString());
 
             // logs the exception at debug level
+            if (LOGGER.isDebugEnabled()) {
+                debugLogStackTrace(err);
+            }
+
+            if (isDLQEnabled()) {
+                try {
+                    javaDlqWriter.writeEntry(err.failedEvent(), "if-statement", "if-statement", "condition evaluation error, " + lastErrorEvaluationReceived);
+                } catch (IOException ioex) {
+                    LOGGER.error("Can't write in DLQ", ioex);
+                }
+            }
+        }
+
+        private boolean isDLQEnabled() {
+            return javaDlqWriter != null;
+        }
+
+        private void debugLogStackTrace(ConditionalEvaluationError err) {
             try (StringWriter sw = new StringWriter(); PrintWriter pw = new PrintWriter(sw)) {
                 err.printStackTrace(pw);
                 LOGGER.debug("{}", sw);
@@ -372,7 +395,7 @@ public IRubyObject lirExecution(final ThreadContext context) {
     public final IRubyObject dlqWriter(final ThreadContext context) {
         if (dlqWriter == null) {
             if (dlqEnabled(context).isTrue()) {
-                final DeadLetterQueueWriter javaDlqWriter = createDeadLetterQueueWriterFromSettings(context);
+                javaDlqWriter = createDeadLetterQueueWriterFromSettings(context);
                 dlqWriter = JavaUtil.convertJavaToUsableRubyObject(context.runtime, javaDlqWriter);
             } else {
                 dlqWriter = RubyUtil.DUMMY_DLQ_WRITER_CLASS.callMethod(context, "new");