About event.cancel

[buch11]

Hey Guys,

In my logstash setup, I have a chain of three plugins

input plugin > custom plugin 1 > custom plugin 2 > output plugin

In my currently implementation, I have wrapped code of both custom plugins inside begin...rescue block. What I want to achieve is - if there are any exceptions raised, I want to drop that event in a way that it never reaches output plugin.

Is "event.cancel" the best way to achieve this?

I see logstash drop filter using the same - https://github.com/logstash-plugins/logstash-filter-drop/blob/ef8ef65a82dd2227c3f28b15cf1a693ebcce6201/lib/logstash/filters/drop.rb#L42

[buch11]

Just tried above mentioned approach without luck! Logstash is forwarding the event to next plugin in chain. Is there any way to stop such events from propagating into the pipeline?

My code looks like below :

def encode(event)
    <some code setting up dw>

    begin
      dw.write(clean_event(event), encoder)
    rescue Avro::IO::AvroTypeError => avroTypeException
      @logger.error(avroTypeException.message)
      @logger.error("[ AvroSchema Mismatch ]: "+ event.get("[header][correlationId]"))
      event.cancel
      @logger.error("Event dropped")
    rescue => genericException
      @logger.error("Unknown Exception occurred - " + genericException.message)
      @logger.error(genericException.backtrace.join("\n"))
      event.cancel
      @logger.error("Event dropped")
    end

    if @binary_encoded
       @on_event.call(event, buffer.string)
    else
       @on_event.call(event, Base64.strict_encode64(buffer.string))
    end
  end

[buch11]

BUMP.

[Badger]

@buch11

Is "event.cancel" the best way to achieve this?

Most likely, yes. A workaround would be to add a tag to the event and then use

if "someValue" in [tags] { drop {} }

What does @on_event.call do? Could it be resurrecting the cancelled event? If so you could try moving it inside the begin block.