Elasticsearch filter plugin won't return failure tag

(infamous) #1

Hi all,

I am using the elasticsearch filter plugin on 5.5 for a configuration and using the tag_on_failure option to do additional sorting. When does the tag_on_failure option trigger? I know it counts as a failure when there is no such index to search from. But is it supposed to trigger when it can not find the specified event?

I am testing this using this config:

input {
	file {

filter {
	json {
		source => "message"
	date {
		match => ["startDateTime", "yyyy-MM-dd'T'HH:mm:ss'Z'"]
	ruby { 
		code => "event.set('epoc', event.get('@timestamp').to_i * 1000)" 
	elasticsearch {
			hosts => ["localhost:9200"]
			index => "myindex"
			query => "@timestamp:%{epoc}"
			fields => {"newfield" => "olddata"}
			tag_on_failure => ["_elasticsearch_lookup_failure"]
			add_field => {"status" => "success"}

output {
	stdout{codec => rubydebug {metadata => true}}

I have manually checked that the event's timestamp getting ingested by the file input does not correspond to any event in the index I am searching against. In other words, the elasticsearch filter will for sure not find any event on query.

Does the plugin not fail if it can't find an old event?


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.