Issues with multiple mutate/gsub filters causing some events not to be indexed

Description

[More details on attached pdf, configuration and sample logs, screen captures]

Consider the following scenario:

  • Two file inputs reading files, one from an app called Lion6 (type=Lion6) and another from JBoss (type=JBoss-SL).

  • Need to use gsub to manipulate dates into a valid timestamp. So two mutate filters are used, an "if" conditional is written to choose between the correct type.

  • If both mutates are active, Lion6 events are not loaded, just Jboss ones. The same issue hapens if only just one mutate is used with the following regex [\s\t].

Activity

Show:
Philippe Weber
August 1, 2014, 8:23 AM

Fixed in 1.4.x as related to the @timestamp manipulation

A little more aggressive garbage-collect on jira.com, expecting follow-up activities to take place on github issues

Assignee

Logstash Developers

Reporter

Marcos

Affects versions

Configure