Skip to:
Events generated by the metrics filter do not obey conditionals. They get processed by every filter after regardless of conditionals surrounding them.
The config below:input {generator {type => "generated"}}
filter {if [type] == "generated" {metrics {meter => "events"add_tag => "metric"}}
if [type] == "should_never_happen" {mutate {add_tag=> ["should_never_be_added"]}}}
output {if "metric" in [tags] {stdout {debug => true}}}
returns this output:
{"@version" => "1","@timestamp" => "2013-12-30T19:10:22.412Z","message" => "ip-10-0-1-36","events.count" => 13285,"events.rate_1m" => 0.0,"events.rate_5m" => 0.0,"events.rate_15m" => 0.0,"tags" => [[0] "metric",[1] "should_never_be_added"]}{"@version" => "1","@timestamp" => "2013-12-30T19:10:27.407Z","message" => "ip-10-0-1-36","events.count" => 54549,"events.rate_1m" => 2657.2,"events.rate_5m" => 2657.2,"events.rate_15m" => 2657.2,"tags" => [[0] "metric",[1] "should_never_be_added"]}
Dup of 1695
I believe this is a dupe of LOGSTASH-1695.
Events generated by the metrics filter do not obey conditionals. They get processed by every filter after regardless of conditionals surrounding them.
The config below:
input {
generator {
type => "generated"
}
}
filter {
if [type] == "generated" {
metrics {
meter => "events"
add_tag => "metric"
}
}
if [type] == "should_never_happen" {
mutate {
add_tag=> ["should_never_be_added"]
}
}
}
output {
if "metric" in [tags] {
stdout {
debug => true
}
}
}
returns this output:
{
"@version" => "1",
"@timestamp" => "2013-12-30T19:10:22.412Z",
"message" => "ip-10-0-1-36",
"events.count" => 13285,
"events.rate_1m" => 0.0,
"events.rate_5m" => 0.0,
"events.rate_15m" => 0.0,
"tags" => [
[0] "metric",
[1] "should_never_be_added"
]
}
{
"@version" => "1",
"@timestamp" => "2013-12-30T19:10:27.407Z",
"message" => "ip-10-0-1-36",
"events.count" => 54549,
"events.rate_1m" => 2657.2,
"events.rate_5m" => 2657.2,
"events.rate_15m" => 2657.2,
"tags" => [
[0] "metric",
[1] "should_never_be_added"
]
}