We're updating the issue view to help you get more done. 

Clone filter does not work if only add_field option is used

Description

Having following configuration

1 2 3 4 5 input { stdin{ codec => "json" } } filter { clone { add_field => { state" => "ok" } } } output { stdout { codec => "json" }}

And passing a line on stdin gives only the same line on output with added @timestamp and @version while the desired state field is missing. This is

Stdin:

1 {"host":"host","field":"value"}

Stdout:

1 {"host":"host","field":"value","@version":"1","@timestamp":"2014-04-25T08:37:34.286Z"}

If I extend clone configuration with

1 clones => ["cloned"]

I get correctly 2 events with the field state added to the clone and type also.

1 2 {"host":"host","field":"value"} {"host":"host","field":"value","@version":"1","@timestamp":"2014-04-25T08:39:41.187Z"}{"host":"host","field":"value","@version":"1","@timestamp":"2014-04-25T08:39:41.187Z","type":"cloned","state":"ok"}

Environment

None

Status

Assignee

Philippe Weber

Reporter

Martin Hynar

Labels

None

Affects versions

1.4.0

Priority