EDIT: The metrics filter injects its events into the stream, but those events are not applied against conditionals in the intended manner.
Gist from electrical illustrating this:
The metrics filter does not seem to work if there is also a multiline filter in the configuration. It doesn't matter if the events match the multiline filter or not. If the multiline filter is commented out, metrics work as expected. No errors or messages are logged. Here is a very simplified config to illustrate this:
I agree that the most logical solution would be what Jordan outlined as essentially the resulting events would continue in the pipeline where they were generated. Implementing this is probably complex, but ultimately I would say its the best solution. That said, if its easier in the meantime to push a patch out that flushes events to the beginning and is documented, the community might benefit from being able to use functionality until a final comprehensive fix can be completed.
I'm still seeing this behavior in 1.4.0. If I have put a metrics filter before a grok filter, the grok filter (which is behind a conditional) tramples all over the data in the metric event.
Sure will. That's some epic work there