Logstash 5.0.2 not removing tags field

I remove tags wield via mutate remove_fields statement.
Logstash 5.0.1 and 5.0.2 is not removing tags field.
Logstash 5.0.0 and 2.4.1 is removing tags field.

Logstash test config:
input { stdin { tags => ["test"] } }
filter { if "test" in [tags] { mutate { remove_field => [ "tags" ] } } }
output { stdout { codec => rubydebug } }

Input anything in stdin.

Output 5.0.2:
{
"@timestamp" => 2016-11-30T13:59:09.441Z,
"@version" => "1",
"host" => "vanilin",
"message" => "test",
"tags" => []
}
Output 5.0.1:
{
"@timestamp" => 2016-11-30T13:59:31.552Z,
"@version" => "1",
"host" => "vanilin",
"message" => "test",
"tags" => []
}
Output 5.0.0:
{
"@timestamp" => 2016-11-30T13:59:46.944Z,
"@version" => "1",
"host" => "vanilin",
"message" => "test"
}
Output 2.4.1:
{
"message" => "test",
"@version" => "1",
"@timestamp" => "2016-11-30T14:00:12.034Z",
"host" => "vanilin"
}

If I add --debug switch I see all versions try remove "tags".
[2016-11-30T17:07:41,463][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"tags"}
But 5.0.1 and 5.0.2 still leave field empty.
Look like something is changed if the grok message processing logic, is this field mandatory now?

I can confirm seeing this behavior as well in my testing. It causes documents to fail indexing for indices where strict mappings are used.

@xerxes9000sx would you be willing to open a Github issue on this in the logstash repo? If not happy to do it but prefer to have it come from the community and folks who first reported it.

I have the same issue. Any luck resolving it?

My option is return to 5.0.0

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.