Open TheVastyDeep opened 5 years ago
If the source field does not exist most filters (csv, date, grok, kv) are a no-op. They silently do nothing. The geoip adds the lookup failure tag. I think that is undesireable. If it cannot changed then it should be documented, since is unexpected.
If the source field does not exist most filters (csv, date, grok, kv) are a no-op. They silently do nothing. The geoip adds the lookup failure tag. I think that is undesireable. If it cannot changed then it should be documented, since is unexpected.