Clone filter does not work if only add_field option is used
Description
testing discovered
Gliffy Diagrams
Activity
Martin Hynar April 28, 2014 at 11:05 AM
Oh, now I understand. Thanks!
Philippe Weber April 28, 2014 at 10:01 AM
I understood correctly, but still this is the behaviour of the clone filter:
A new clone will be created with the given type for each type in this list.
So as you don't specify a list in clones is default to an empty list and thus do NOT create any clones
Martin Hynar April 28, 2014 at 8:58 AM
I made the output bit confusing. The configuration without clones gives only one event on the stdout. There is no cloned event with the field I want to add.
Philippe Weber April 25, 2014 at 10:51 AM
It is the default behaviour of this filter as documented,
The original event is left unchanged.
the additional add_field, add_tag are applied to the cloned event only.
normally, you would use further filters to be applied to either the clone or the event.
However be aware of the current issue as documented in linked issues.
Having following configuration
And passing a line on stdin gives only the same line on output with added
@timestampand@versionwhile the desiredstatefield is missing. This isStdin:
Stdout:
If I extend
cloneconfiguration withI get correctly 2 events with the field
stateadded to the clone andtypealso.