I have a basic conf file that I'm trying to eventually drop dns traffic but for some reason I can't get the if conditionals to work anymore. Below is all that is in this conf file. I've also tried changing the if statement to if "flow" in [tags] as well but same result. I have other conf files with conditionals that are working just fine so I'm stumped on what's wrong with this one.
Do you actually drop traffic that has the dns_traffic tag? Is it possible that the flow tag is getting added later in the process? Otherwise I cannot think of why this would not work.
Yep, that's exactly what it was. My new conf began with 1010 while the conf that adds the flow tags began with 5000. I changed it to 5010 but it still didn't work however if I change it to letters first ABC5010 then it works. What is the order for processing these files?
The documentation states that if path.config is a directory (or wildcard) then "all files in that directory will be concatenated in lexicographical order and then parsed as a single config file". In lexigraphical order in Java numbers come before letters.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.