The tag_on_failure setting for the grok filter is very helpful with longer pipelines containing multiple grok filters, making it easier to locate the error in the pipeline, and more robust error handling.
For example, if a pipeline contained multiple json filters, the ambiguous _jsonparsefailure is informative, but not entirely helpful.
strootman
commented
7 years ago
The
tag_on_failuresetting for the grok filter is very helpful with longer pipelines containing multiple grok filters, making it easier to locate the error in the pipeline, and more robust error handling.For example, if a pipeline contained multiple json filters, the ambiguous
_jsonparsefailureis informative, but not entirely helpful.