The KV plugin will happily overwrite pre-existing fields in the event stream when splitting, including fields that have special meaning such as "type." Proposed feature set would include three options for kv:
1) Allow all overwrites (current behavior)
2) Disallow generated fields to overwrite existing fields.
3) Allow user to specify an array of fields which kv generator can overwrite, still allowing new fields to be introduced.
The KV plugin will happily overwrite pre-existing fields in the event stream when splitting, including fields that have special meaning such as "type." Proposed feature set would include three options for kv: 1) Allow all overwrites (current behavior) 2) Disallow generated fields to overwrite existing fields. 3) Allow user to specify an array of fields which kv generator can overwrite, still allowing new fields to be introduced.
From https://logstash.jira.com/browse/LOGSTASH-2236