search

magnusbaeck / logstash-filter-verifier

Apache License 2.0
192 stars 27 forks source link

Testing cloned events #81

Closed jgough closed 4 years ago

jgough commented 4 years ago

If an event is cloned using the clone filter then two events are outputted instead of one.

For example this config will output two events - one with slashes replaced with underscores in the message:

filter {
  clone { clones => [ "underscores" ] }

  if [type] == "underscores" {
    mutate { gsub => [ "message", "/" "_" ] }
  }
}

I can't see any way of testing events that have been cloned. Is there something that I can do to test this? If not, can this be a feature request for cloned event support?

magnusbaeck commented 4 years ago

Can't you list one event in the input list and two events in the expected list?

jgough commented 4 years ago

Could have sworn I tried this, but that does seem to work! Thanks :-)