Can we add field in _grokparsefailure if block?


(gaurav kant) #1

is it possible like below?

if "_grokparsefailure" in [tags] {
add_field => ["exceptionClass", "other"]
drop {}
}

right now it is throwing error.


(Magnus B├Ąck) #2

Put the add_field line inside a mutate filter.

But what's the point of adding a tag to an event if you're deleting it on the next line?


(gaurav kant) #3

sorry i mentioned drop by mistake. i dont wanna drop that line, just add a new field in case match fails.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.