Issues with multiple mutate/gsub filters causing some events not to be indexed
Description
Attachments
1
- 18 Oct 2013, 11:29 PM
Gliffy Diagrams
Activity
Show:
Philippe Weber August 1, 2014 at 8:23 AM
Fixed in 1.4.x as related to the @timestamp manipulation
A little more aggressive garbage-collect on jira.com, expecting follow-up activities to take place on github issues
[More details on attached pdf, configuration and sample logs, screen captures]
Consider the following scenario:
Two file inputs reading files, one from an app called Lion6 (type=Lion6) and another from JBoss (type=JBoss-SL).
Need to use gsub to manipulate dates into a valid timestamp. So two mutate filters are used, an "if" conditional is written to choose between the correct type.
If both mutates are active, Lion6 events are not loaded, just Jboss ones. The same issue hapens if only just one mutate is used with the following regex [\s\t].