{"record":{"id":"a383d67bfdcc1245","repo":"apache/beam","slug":"error-when-reading-s","errorCode":null,"errorMessage":"Error when reading: %s","messagePattern":"Error when reading: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/splunk/src/main/java/org/apache/beam/sdk/io/splunk/SplunkEventWriter.java","lineNumber":450,"sourceCode":"\n      receiver.output(error);\n    }\n  }\n\n  /**\n   * Reads a root CA certificate from GCS and returns it as raw bytes.\n   *\n   * @param filePath path to root CA cert in GCS\n   * @return raw contents of cert\n   * @throws RuntimeException thrown if not able to read or parse cert\n   */\n  public static byte[] getCertFromGcsAsBytes(String filePath) throws IOException {\n    MatchResult.Metadata fileMetadata = FileSystems.matchSingleFileSpec(filePath);\n    ReadableByteChannel channel = FileSystems.open(fileMetadata.resourceId());\n    try (InputStream inputStream = Channels.newInputStream(channel)) {\n      return IOUtils.toByteArray(inputStream);\n    } catch (IOException e) {\n      throw new RuntimeException(\"Error when reading: \" + filePath, e);\n    }\n  }\n\n  @VisibleForTesting\n  static boolean isValidUrlFormat(String url) {\n    Matcher matcher = URL_PATTERN.matcher(url);\n    if (matcher.find()) {\n      String host = matcher.group(2);\n      return InetAddresses.isInetAddress(host) || InternetDomainName.isValid(host);\n    }\n    return false;\n  }\n\n  /**\n   * Converts Nanoseconds to Milliseconds.\n   *\n   * @param ns time in nanoseconds\n   * @return time in milliseconds","sourceCodeStart":432,"sourceCodeEnd":468,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/splunk/src/main/java/org/apache/beam/sdk/io/splunk/SplunkEventWriter.java#L432-L468","documentation":"During Splunk sink setup, the SSL certificate file is fetched from GCS via FileSystems.matchSingleFileSpec and read fully into bytes. If any IOException occurs while matching/opening/reading the file, the code wraps it in a RuntimeException carrying the path. It usually means the path doesn't exist, isn't readable, or the GCS filesystem/credentials aren't configured.","triggerScenarios":"Calling SplunkIO.writeSsl(...) or configuring the writer with a GCS cert path via withCertFilePath()/setup() where the path fails FileSystems.match, the object was deleted/renamed, or credentials lack storage.objects.get.","commonSituations":"Typos in gs:// paths, service accounts without GCS read permission, missing GCS/relay URL config in Dataflow, or referencing a local path when running on a worker where only GCS is mounted.","solutions":["Verify the exact gs://bucket/path exists (gsutil ls) and the path is the file itself, not a directory or glob.","Grant the pipeline's service account roles/storage.objectViewer on the bucket.","Prefer uploading the cert via a supported scheme for your environment, or inline/pass the cert bytes directly instead of a GCS reference.","Check the wrapped cause (getCause()) to distinguish match failures from stream read failures."],"exampleFix":"// before\nSplunkIO.writeEvents(\"https://splunk:8088\").withToken(token)\n    .withCertFilePath(\"gs://mybucket/certs/splunk.crt\")\n// after (verify first)\ngsutil ls gs://mybucket/certs/splunk.crt  # ensure it exists and is readable\nSplunkIO.writeEvents(\"https://splunk:8088\").withToken(token)\n    .withCertFilePath(\"gs://mybucket/certs/splunk.crt\")","handlingStrategy":"validation","validationCode":"// Java — verify the GCS object exists and is readable before configuring the sink\nMatchResult r = FileSystems.match(Collections.singletonList(\"gs://bucket/certs/splunk.crt\"));\nif (r.status() != MatchResult.Status.OK || r.metadata().isEmpty()) {\n  throw new IllegalStateException(\"Cert not found at gs://bucket/certs/splunk.crt\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  byte[] cert = SplunkEventWriter.getCertFromGcsAsBytes(path);\n} catch (RuntimeException e) {\n  if (e.getCause() instanceof IOException) {\n    throw new IllegalStateException(\"Unreadable cert path: \" + path, e.getCause());\n  }\n  throw e;\n}","preventionTips":["gsutil ls the cert path before launching the pipeline.","Grant the worker service account storage.objectViewer on the cert bucket.","Check whether the pipeline environment requires GCS (Dataflow) vs local filesystem access."],"tags":["apache-beam","java","gcs","splunk","file-read"],"backgroundTag":"file-read-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}