Uploaded image for project: 'logstash'
  1. LOGSTASH-1197

filter grok tag_on_failure no longer accepts false

    Details

    • Type: Bug/Feature
    • Status: Resolved (View workflow)
    • Resolution: Won't Fix
    • Affects Version/s: 1.1.13
    • Fix Version/s: None
    • Labels:

      Description

      I have a grok where I want to tag up events based on which host they're from, e.g.:

      filter {
        grok {
          pattern => [ "%{SYSLOGTIMESTAMP} myservice-prod-role" ]
          add_tag => [ "myservice" ]
        }
      }
      

      However, since logstash reads log from multiple hosts that grok will
      fail, but I don't want the event to be tagged as "_grokparsefailure".

      And sure I can have this just after my grok:

        mutate {
          tags => [ "myservice", "_grokparsefailure" ]
          remove_tag => [ "_grokparsefailure" ]
        }
      

      But I'd rather just write (without the mutate):

        grok {
          pattern => [ "%{SYSLOGTIMESTAMP} myservice-prod-role" ]
          add_tag => [ "myservice" ]
          tag_on_failure => false
        }
      

      but that adds a tag called "false"... = )

      According to devOpsEv on IRC this worked in 1.1.10 but changed and I
      suspect it's on this commit https://github.com/logstash/logstash/commit/f0196dbdc0c9578fd51e8da193b8fe17189a160c

      Not sure how to support both an array and a bool so I just did a
      bugreport.

      In summary:
      Ideally, both tag_on_failure => false and {{tag_on_failure => [
      "tagz" ]}} should work.

      Br,

      • Simon

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                logstash-dev Logstash Developers (Inactive)
                Reporter:
                simmel Simon Lundström
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: