Logstash filter plugin

I am using Logstash version 7.14.0. I would like to parse message to the top level of message. So this is my configuration:

        json {
          skip_on_invalid_json => true
          source => "message"
          tag_on_failure => ["_jsonparsefailure"]
        }

When the message is JSON, it works. If message is not JSON, I would expect that the message will be tagged with _jsonparsefailure but it is not true. From the documentation, I can see that with setting skip_on_invalid_json => true the json filter will be skipped so I assume it will also skipped the tagging?

I would expect from this configuratoin that in case, message is not JSON, it will just tag the message but not print any warning into logs - because of skip_on_invalid_json => true.

Now I do not know how to filter messages which are not json.

Could anybody explain me if I understand correctly and explain, how to achieve to tag a not JSON messages ?

Thank you.

Both the error message and the tagging are conditional upon the same option in the code. You cannot get one without the other.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.