Logstash holding events


(Cónall Prendergast) #1

Hi,

I am trying to make a simple test plugin that will hold every second event and release it with the next event, on the next event.

So, given an input sequence of events like so:

1..2..3..4..5..6..7..8

I want an output sequence of events like so:

nil..[1,2]..nil..[3,4]..nil..[5,6]..nil..[7,8]

I am not quite sure how to do this, I have tried "yielding" the events but to no avail.
Any help is appreciated.
Thanks.

PS. What does the "filter_matched" method actually do?


(Magnus Bäck) #2

PS. What does the "filter_matched" method actually do?

It indicates that the filter was successful. Successful filter invocations result in the add_field and add_tag options being applied.


(Cónall Prendergast) #3

Thanks @magnusbaeck

For reference, I got it working. Find code below.

class LogStash::Filters::Test < LogStash::Filters::Base

  config_name "test"


  @@stored_event = nil
  public
  def register
  end

  public
  def filter(event)
if @@stored_event.nil?
    @@stored_event = event
    event.cancel()
else
    filter_matched(event)
    yield event

    filter_matched(@@stored_event)
    yield @@stored_event
    @@stored_event = nil
end



  end
end

(Cónall Prendergast) #4

Hi @magnusbaeck,

I have discovered that when events are cancelled, they continue and locally cached above, they continue on down the pipeline.

So when we have two filters, and the first filter cancels and event, it actually immediately reaches the second filter where it can get altered.

How can I avoid this?

Regards


(Cónall Prendergast) #5

This seems to only happen when the date filter is downstream


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.