# Logstash holding events

**URL:** <https://discuss.elastic.co/t/logstash-holding-events/83539>\
**Category:** Logstash\
**Created:** [April 25, 2017, 10:10am UTC](https://discuss.elastic.co/t/logstash-holding-events/83539 "2017-04-25T10:10:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\
**Post date:** [April 25, 2017, 10:10am UTC](https://discuss.elastic.co/t/logstash-holding-events/83539/1 "2017-04-25T10:10:04Z")

</div>

Hi,

I am trying to make a simple test plugin that will hold every second event and release it with the next event, on the next event.

So, given an input sequence of events like so:

```
1..2..3..4..5..6..7..8

```

I want an output sequence of events like so:

```
nil..[1,2]..nil..[3,4]..nil..[5,6]..nil..[7,8]

```

I am not quite sure how to do this, I have tried "yielding" the events but to no avail.  
Any help is appreciated.  
Thanks.

PS. What does the "filter\_matched" method actually do?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 25, 2017, 10:12am UTC](https://discuss.elastic.co/t/logstash-holding-events/83539/2 "2017-04-25T10:12:02Z")

</div>

> PS. What does the "filter\_matched" method actually do?

It indicates that the filter was successful. Successful filter invocations result in the `add_field` and `add_tag` options being applied.

---

<div class="post-metadata">

**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\
**Post date:** [April 25, 2017, 10:28am UTC](https://discuss.elastic.co/t/logstash-holding-events/83539/3 "2017-04-25T10:28:05Z")

</div>

Thanks @magnusbaeck

For reference, I got it working. Find code below.

```
class LogStash::Filters::Test < LogStash::Filters::Base

  config_name "test"

  @@stored_event = nil
  public
  def register
  end

  public
  def filter(event)
if @@stored_event.nil?
    @@stored_event = event
    event.cancel()
else
    filter_matched(event)
    yield event

    filter_matched(@@stored_event)
    yield @@stored_event
    @@stored_event = nil
end

  end
end
```

---

<div class="post-metadata">

**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\
**Post date:** [May 4, 2017, 4:04pm UTC](https://discuss.elastic.co/t/logstash-holding-events/83539/4 "2017-05-04T16:04:18Z")

</div>

Hi @magnusbaeck,

I have discovered that when events are cancelled, they continue and locally cached above, they continue on down the pipeline.

So when we have two filters, and the first filter cancels and event, it actually immediately reaches the second filter where it can get altered.

How can I avoid this?

Regards

---

<div class="post-metadata">

**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\
**Post date:** [May 4, 2017, 4:20pm UTC](https://discuss.elastic.co/t/logstash-holding-events/83539/5 "2017-05-04T16:20:31Z")

</div>

This seems to only happen when the date filter is downstream

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2017, 4:30pm UTC](https://discuss.elastic.co/t/logstash-holding-events/83539/6 "2017-06-01T16:30:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.