I have the following simple
when.not I am using for testing:
processors: - decode_json_fields: when.not: or: - equals.input.type: "docker" fields: ["log"] target: "log_json" process_array: true max_depth: 20
Although, I am still seeing events that have and input.type equal to "docker" being processed. Is this syntax correct? I am using an
or here as a test as I will have more than one not condition once I get this simple one working.