Atlassian uses cookies to improve your browsing experience, perform analytics and research, and conduct advertising. Accept all cookies to indicate that you agree to our use of cookies on your device. Atlassian cookies and tracking notice, (opens new window)
Issues with multiple mutate/gsub filters causing some events not to be indexed
Fixed
Description
[More details on attached pdf, configuration and sample logs, screen captures]
Consider the following scenario:
Two file inputs reading files, one from an app called Lion6 (type=Lion6) and another from JBoss (type=JBoss-SL).
Need to use gsub to manipulate dates into a valid timestamp. So two mutate filters are used, an "if" conditional is written to choose between the correct type.
If both mutates are active, Lion6 events are not loaded, just Jboss ones. The same issue hapens if only just one mutate is used with the following regex [\s\t].
[More details on attached pdf, configuration and sample logs, screen captures]
Consider the following scenario:
Two file inputs reading files, one from an app called Lion6 (type=Lion6) and another from JBoss (type=JBoss-SL).
Need to use gsub to manipulate dates into a valid timestamp. So two mutate filters are used, an "if" conditional is written to choose between the correct type.
If both mutates are active, Lion6 events are not loaded, just Jboss ones. The same issue hapens if only just one mutate is used with the following regex [\s\t].