Issues with multiple mutate/gsub filters causing some events not to be indexed

Description

[More details on attached pdf, configuration and sample logs, screen captures]

Consider the following scenario:

  • Two file inputs reading files, one from an app called Lion6 (type=Lion6) and another from JBoss (type=JBoss-SL).

  • Need to use gsub to manipulate dates into a valid timestamp. So two mutate filters are used, an "if" conditional is written to choose between the correct type.

  • If both mutates are active, Lion6 events are not loaded, just Jboss ones. The same issue hapens if only just one mutate is used with the following regex [\s\t].

Attachments

1
  • 18 Oct 2013, 11:29 PM

Gliffy Diagrams

Activity

Show:

Philippe Weber August 1, 2014 at 8:23 AM

Fixed in 1.4.x as related to the @timestamp manipulation

A little more aggressive garbage-collect on jira.com, expecting follow-up activities to take place on github issues

Fixed

Details

Assignee

Reporter

Affects versions

Created October 18, 2013 at 11:29 PM
Updated August 1, 2014 at 8:23 AM
Resolved August 1, 2014 at 8:23 AM