Hi, I'm new at using logstash. I'm trying to use throttling in my filter and every message is getting throttled for some reason. Do I have an error in my config?
I was expecting every 2nd, 3rd, and 4th message containing "STUFF" to have the tag "SEND_EMAIL" added to it. But instead every message has the tag "throttled".
if "STUFF" in [message] { throttle { before_count => 2 after_count => 4 period => 600 key => "%{message}" add_tag => "throttled" } } if "throttled" not in [tags] { mutate { add_tag => "SEND_EMAIL" } }