Open MikeKemmerer opened 6 years ago
Under what circumstances would a tag be cleaner? Surely, if one sets the fallback
to be "hey, translate 101 did not work" then:
if [destination] != "hey, translate 101 did not work" {
mutate {
remove_field => ["destination']
}
is no different from an tags include if conditional? What am I missing?
While it's nice to have a default if there's no match, it would be nice to have the ability to tag data that doesn't have a match in the dictionary. Otherwise, I'll have to perform a
remove_field
to get rid of the default data after the rest of the work is done on a non-matching event. Having the tag to work with would be cleaner.Thanks.