Can we add field in _grokparsefailure if block?

is it possible like below?

if "_grokparsefailure" in [tags] {
add_field => ["exceptionClass", "other"]
drop {}

right now it is throwing error.

Put the add_field line inside a mutate filter.

But what's the point of adding a tag to an event if you're deleting it on the next line?

sorry i mentioned drop by mistake. i dont wanna drop that line, just add a new field in case match fails.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.