Open webmstr opened 9 years ago
Based on what you've provided, I agree this is a bug.
+1 Even in v3.2.3 I experiencing this.
@jordansissel The problem is in the inner loop in match_against_groks. The outer loop in method filter retains the state of 'matched' just fine, but the inner loop overwrites 'matched' for each pattern (because it is also using it to store the set of matches), so tag_on_failure only applies to the last pattern. Consider this:
input { generator { count => 1 lines => [ '{"foo": "DEBUG"}', '{"bar": "DEBUG"}'] } }
filter {
json { source => "message" }
grok {
break_on_match => false
match => {
"foo" => [ "INFO", "DEBUG" ]
"bar" => [ "DEBUG", "INFO" ]
}
}
}
output { stdout { } }
The second event gets a _grokparsefailure tag, but the first does not. Unexpected.
If you have a grok filter with multiple matches and break_on_match set to false, the event will have tag_on_failure applied unless the last pattern matches. This is a change from 1.4.
Sending in input of:
Gives:
In 1.4, only "spam" would be tagged as "failure".