For our application we needs an additional custom field in the record to indicate throttling instead of discarding it. Based on that we will do post processing things on that record. This new field should be named "add_field," and the flag associated with it will determine whether the record should be dropped or modified, allowing it to continue with further processing.
<filter syslog.**>
@type throttle
group_key type
group_bucket_period_s 60
group_bucket_limit 5000
group_reset_rate_s -1
add_field throttled # added acknowledgment like yes for this field.
proceed_further true #defaults as false.
</filter>
Hi,
For our application we needs an additional custom field in the record to indicate throttling instead of discarding it. Based on that we will do post processing things on that record. This new field should be named "add_field," and the flag associated with it will determine whether the record should be dropped or modified, allowing it to continue with further processing.
We would appreciate your input on this.