Drop_event when up is false

[alkuzad]

I can't get drop_event to work with up field.

I'm using heartbeat version 5.4.3

Up is simple boolean field and it seems equals condition do not support booleans. So neither "false" or "False" or 0, 1 works. Range filter does not work either.

How to create processor that drop events when service is running normally ?

[exekias (Carlos Pérez Aradros)]

Can you please share the settings you are using? It should help others to analyze what may be wrong

[alkuzad]

heartbeat.monitors:
- type: http
  schedule: '@every 2m'
  urls: ["http://service.example.com"]
  check.response.status: 200
heartbeat.scheduler:
  limit: 25
output.logstash:
  hosts: ["logstash.example.com:5044"]
processors:
 - drop_event:
     when:
      XXX

Where XXX is one of:

equals: 
  up: False

equals: 
  up: false

equals: 
  up: "false"

equals:
  up: 0

equals:
  up: 1

range:
 up:
  gt: 0

range:
 up:
  lt: 1

[andrewkroh]

This looks like a bug due to the equals condition not supporting booleans. Please open an issue on Github.

This is the part of the code doing the check and it only supports int and string. https://github.com/elastic/beats/blob/5ddd68527bd3335b0c450549f6b7d80c0f5cf86e/libbeat/processors/condition.go#L252-L266

[steffens (Steffen Siering)]

Note: For beats 6.0 release the heartbeat event format is going to be changed (more normalized with other beats): https://github.com/elastic/beats/pull/4091

This change should be already included in the 6.0 alpha2 release.

The boolean up field has been replaced with monitor.status of type string (currently 'up' or 'down').

[alkuzad]

@andrewkroh thanks for finding specific code for that I've opened issue: https://github.com/elastic/beats/issues/4637

@steffens nice, we are experimenting with Heartbeat as it can be fully configured directly in AWS CloudFormation, without using a lot of hacks. Unfortunately my team is too small now to start experimenting with 6.0 when we are still in 2.4 after lots of changes made to get rid of buggy 1.7 (when we had to patch logstash plugins for a while because it was easier than upgrade)