tag_on_failure as array

[Sakorah]

In many other filters (dissect, grok, json, ...) tag_on_failure is an array allowing multiple tags to be assigned on failure. For KV this is only a string.

Use case:

            kv {
                source => "message"
                prefix => "kv_"
                tag_on_failure => [ "_kv_filter_error", "_kv_firstpattern"]
            }
            kv {
                source => "kv_message"
                prefix => "kv2_"
                tag_on_failure => [ "_kv_filter_error", "_kv_secondpattern"]
            }

This allows to filter and identify where the failure happened if multiple kv filters are used.

[mashhurs]

Released with logstash-filter-kv v4.7.0.