Elasticsearch ingest pipeline drop processor no worky :(

Elastic Stack Elasticsearch
1

Hello fellow log ingestors,

I have an ingest pipeline to ingest logs however I want to drop the document if it contains a certain string in the message field. I am trying to use the drop processor for this but the document does not seem to get dropped.

I have the following drop processor:

"drop": {
               "if" : "ctx.message == '(^commit{dir=.+)'"
            },

I am expecting this to drop any document with a matching expression in the message field but this is not happening. Am I misunderstanding how this processor works?

Thanks

2

Ok, so after much googling I found this https://github.com/elastic/elasticsearch/issues/36150. :woman_facepalming:

This is a known bug which is fixed in 7.4

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.