# About event.cancel

**URL:** <https://discuss.elastic.co/t/about-event-cancel/224335>\
**Category:** Logstash\
**Created:** [March 20, 2020, 1:37am UTC](https://discuss.elastic.co/t/about-event-cancel/224335 "2020-03-20T01:37:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)\
**Post date:** [March 20, 2020, 1:37am UTC](https://discuss.elastic.co/t/about-event-cancel/224335/1 "2020-03-20T01:37:33Z")

</div>

Hey Guys,

In my logstash setup, I have a chain of three plugins

input plugin \> custom plugin 1 \> custom plugin 2 \> output plugin

In my currently implementation, I have wrapped code of both custom plugins inside begin...rescue block. What I want to achieve is - if there are any exceptions raised, I want to drop that event in a way that it never reaches output plugin.

Is "event.cancel" the best way to achieve this?

I see logstash drop filter using the same - [https://github.com/logstash-plugins/logstash-filter-drop/blob/ef8ef65a82dd2227c3f28b15cf1a693ebcce6201/lib/logstash/filters/drop.rb#L42](https://github.com/logstash-plugins/logstash-filter-drop/blob/ef8ef65a82dd2227c3f28b15cf1a693ebcce6201/lib/logstash/filters/drop.rb#L42)

---

<div class="post-metadata">

**Author:** ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)\
**Post date:** [March 20, 2020, 7:21am UTC](https://discuss.elastic.co/t/about-event-cancel/224335/2 "2020-03-20T07:21:40Z")

</div>

Just tried above mentioned approach without luck! Logstash is forwarding the event to next plugin in chain. Is there any way to stop such events from propagating into the pipeline?

My code looks like below :

```
def encode(event)
    <some code setting up dw>

    begin
      dw.write(clean_event(event), encoder)
    rescue Avro::IO::AvroTypeError => avroTypeException
      @logger.error(avroTypeException.message)
      @logger.error("[AvroSchema Mismatch]: "+ event.get("[header][correlationId]"))
      event.cancel
      @logger.error("Event dropped")
    rescue => genericException
      @logger.error("Unknown Exception occurred - " + genericException.message)
      @logger.error(genericException.backtrace.join("\n"))
      event.cancel
      @logger.error("Event dropped")
    end

    if @binary_encoded
       @on_event.call(event, buffer.string)
    else
       @on_event.call(event, Base64.strict_encode64(buffer.string))
    end
  end
```

---

<div class="post-metadata">

**Author:** ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)\
**Post date:** [March 23, 2020, 11:28pm UTC](https://discuss.elastic.co/t/about-event-cancel/224335/3 "2020-03-23T23:28:41Z")

</div>

BUMP.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2020, 12:33am UTC](https://discuss.elastic.co/t/about-event-cancel/224335/4 "2020-03-24T00:33:26Z")

</div>

> [@buch11](#):
>
> Is "event.cancel" the best way to achieve this?

Most likely, yes. A workaround would be to add a tag to the event and then use

```
if "someValue" in [tags] { drop {} }

```

What does @on\_event.call do? Could it be resurrecting the cancelled event? If so you could try moving it inside the begin block.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2020, 12:47am UTC](https://discuss.elastic.co/t/about-event-cancel/224335/5 "2020-04-21T00:47:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.