I have a logstash config looking roughly like below:
#ruby <1>
ruby { code => "event['@metadata']['scheduledTime'] = Time.now" }
...
split {
field => "xxx"
target => "yyy"
}
...
#ruby <2>
ruby { code => " #read event['@metadata']['scheduledTime'] and do some calculation " }
Field added in ruby <1> are not carried to ruby<2>. Split filter cloning somehow doesn't carry these fields onward.
The same ruby filters without split between works fine.
Is there a different way to add fields in a ruby filter or is the issue is from split filter?