How to use throttle filter to add tag to only one record

Hi,

I am using Logstash to process a csv file that contains more that one Lakh rows.

I want to add a tag to only one record so that I can send email if any record contains this tag.

I am trying to use throttle but its adding tags to more than one records.

throttle {
before_count => 2
after_count => 1
period => 20
max_age => 900
key => "%{timestamp}"
add_tag => "email"
}

Can someone help me on how to properly use throttle filter to add tag to only one record? Or suggest a better way to do it

Thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.