Open hartfordfive opened 8 years ago
This would be a useful feature if the tag_on_faliure attribute would interpolate dynamic template variables. For example, given a template variable type = syslog:
tag_on_faliure
type = syslog
grok { match => [ "message", "%{SYSLOGBASE:syslog_data}\s+%{GREEDYDATA:message}" ] overwrite => [ "message" ] tag_on_failure => ["_grokparsefailure_%{type}"] }
Should tag the event with _grokparsefailure_syslog but is currently showing up as _grokparsefailure_%{type}
_grokparsefailure_syslog
_grokparsefailure_%{type}
This would be a useful feature if the
tag_on_faliure
attribute would interpolate dynamic template variables. For example, given a template variabletype = syslog
:Should tag the event with
_grokparsefailure_syslog
but is currently showing up as_grokparsefailure_%{type}