Metric filter events (possibly other filters that add events to the stream) are not applied against conditionals correctly

Description

EDIT: The metrics filter injects its events into the stream, but those events are not applied against conditionals in the intended manner.

Gist from electrical illustrating this:

Original find:
The metrics filter does not seem to work if there is also a multiline filter in the configuration. It doesn't matter if the events match the multiline filter or not. If the multiline filter is commented out, metrics work as expected. No errors or messages are logged. Here is a very simplified config to illustrate this:

Activity

Show:
Ryan O'Keeffe
January 21, 2014, 9:33 PM

I agree that the most logical solution would be what Jordan outlined as essentially the resulting events would continue in the pipeline where they were generated. Implementing this is probably complex, but ultimately I would say its the best solution. That said, if its easier in the meantime to push a patch out that flushes events to the beginning and is documented, the community might benefit from being able to use functionality until a final comprehensive fix can be completed.

Daniel Dreier
April 19, 2014, 7:30 AM

I'm still seeing this behavior in 1.4.0. If I have put a metrics filter before a grok filter, the grok filter (which is behind a conditional) tramples all over the data in the metric event.

Ryan O'Keeffe
April 23, 2014, 8:06 PM

https://github.com/elasticsearch/logstash/pull/1260 will fix this. Just needs spec tests and a pull into master. So close!

Philippe Weber
January 24, 2015, 11:58 AM

Fixed in https://github.com/elasticsearch/logstash/pull/1545
This PR will become famous

Lex Neva
January 26, 2015, 6:59 PM

Sure will. That's some epic work there

Assignee

Colin Surprenant

Reporter

Ryan O'Keeffe

Labels

Fix versions

Affects versions

Configure