Logstash holding events

Elastic Stack Logstash
1

Hi,

I am trying to make a simple test plugin that will hold every second event and release it with the next event, on the next event.

So, given an input sequence of events like so:

1..2..3..4..5..6..7..8

I want an output sequence of events like so:

nil..[1,2]..nil..[3,4]..nil..[5,6]..nil..[7,8]

I am not quite sure how to do this, I have tried "yielding" the events but to no avail.
Any help is appreciated.
Thanks.

PS. What does the "filter_matched" method actually do?

2

PS. What does the "filter_matched" method actually do?

It indicates that the filter was successful. Successful filter invocations result in the add_field and add_tag options being applied.

3

Thanks @magnusbaeck

For reference, I got it working. Find code below.

class LogStash::Filters::Test < LogStash::Filters::Base

  config_name "test"


  @@stored_event = nil
  public
  def register
  end

  public
  def filter(event)
if @@stored_event.nil?
    @@stored_event = event
    event.cancel()
else
    filter_matched(event)
    yield event

    filter_matched(@@stored_event)
    yield @@stored_event
    @@stored_event = nil
end



  end
end
4

Hi @magnusbaeck,

I have discovered that when events are cancelled, they continue and locally cached above, they continue on down the pipeline.

So when we have two filters, and the first filter cancels and event, it actually immediately reaches the second filter where it can get altered.

How can I avoid this?

Regards

5

This seems to only happen when the date filter is downstream