Hi, I'm new at using logstash. I'm trying to use throttling in my filter and every message is getting throttled for some reason. Do I have an error in my config?
I was expecting every 2nd, 3rd, and 4th message containing "STUFF" to have the tag "SEND_EMAIL" added to it. But instead every message has the tag "throttled".
if "STUFF" in [message] {
throttle {
before_count => 2
after_count => 4
period => 600
key => "%{message}"
add_tag => "throttled"
}
}
if "throttled" not in [tags] {
mutate {
add_tag => "SEND_EMAIL"
}
}