i want drop the log detail if get _jsonparsefailure
i have applied this inside filter :-
if "_jsonparsefailure" in [tags]{
drop { }
}
but still not resolving my problem i think it will apply only if single value "_jsonparsefailure" inside the tags but in my case getting 2 values "beats_input_codec_json_applied", "_jsonparsefailure"
but still not resolving my problem i think it will apply only if single value "_jsonparsefailure" inside the tags
No, not true.
The little piece of your configuration that you've showed us looks fine. Please show us the full configuration and an example document that should've been dropped but wasn't. Copy/paste from Kibana's JSON tab or use a stdout { codec => rubydebug } output to dump the raw event.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.