filter chaining question

Description

I am attempting to filter through grok with named fields, then filter through a custom filter.

After grok when I call the custom filter the event seems to be the same as before grok.

I am confused on how to chain filters and maintain the changes as the event trickles through them.

I took the basic DNS filter and started with that.

The grok filter works, if I run it without the second filter for crowd I get the results I want in output.

Environment

None

Status

Assignee

Logstash Developers

Reporter

Zachary Buckholz

Priority

Configure