Logstash 5.0.2 not removing tags field

Elastic Stack Logstash
1

I remove tags wield via mutate remove_fields statement.
Logstash 5.0.1 and 5.0.2 is not removing tags field.
Logstash 5.0.0 and 2.4.1 is removing tags field.

Logstash test config:
input { stdin { tags => ["test"] } }
filter { if "test" in [tags] { mutate { remove_field => [ "tags" ] } } }
output { stdout { codec => rubydebug } }

Input anything in stdin.

Output 5.0.2:
{
"@timestamp" => 2016-11-30T13:59:09.441Z,
"@version" => "1",
"host" => "vanilin",
"message" => "test",
"tags" => []
}
Output 5.0.1:
{
"@timestamp" => 2016-11-30T13:59:31.552Z,
"@version" => "1",
"host" => "vanilin",
"message" => "test",
"tags" => []
}
Output 5.0.0:
{
"@timestamp" => 2016-11-30T13:59:46.944Z,
"@version" => "1",
"host" => "vanilin",
"message" => "test"
}
Output 2.4.1:
{
"message" => "test",
"@version" => "1",
"@timestamp" => "2016-11-30T14:00:12.034Z",
"host" => "vanilin"
}

If I add --debug switch I see all versions try remove "tags".
[2016-11-30T17:07:41,463][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"tags"}
But 5.0.1 and 5.0.2 still leave field empty.
Look like something is changed if the grok message processing logic, is this field mandatory now?

2

I can confirm seeing this behavior as well in my testing. It causes documents to fail indexing for indices where strict mappings are used.

3

@xerxes9000sx would you be willing to open a Github issue on this in the logstash repo? If not happy to do it but prefer to have it come from the community and folks who first reported it.

4

I have the same issue. Any luck resolving it?

5

My option is return to 5.0.0

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.