Metric and drop filter not working together

Hi,

I would like throttle events using the logstash-filter-throttle plugin. After that to create a logstash-filter-metric to push it to prometheus using graphite exporter. And finally drop the events that are marked by the throttle plugin.
The issue I face is when I use de drop plugin the metric event does not get created.
Is there way to have both the drop filter and metric filter coexist?

filter {
        throttle {
          id => "main_throttle_filter"
          enable_metric => true
          before_count => -1
          after_count => 50
          period => 60
          max_age => 120
          key => "%{[fields][platform]}"
          add_tag => "throttled_events"
        }

        if "throttled_events" in [tags] {
          metrics {
            id => "throttled_metrics"
            meter => "logstash_throttled_total.%{[fields][platform]}"
            rates => []
            add_tag => "throttled_metrics"
            flush_interval => 30
            ignore_older_than => 120
          }

          drop {
            id => my_throttled_events_drop
          }
        }
    output {
      if "throttled_metrics" in [tags] {
        graphite {
          host => "${GRAPHITE_HOST}"
          port => "${GRAPHITE_PORT}"
          fields_are_metrics => true
        }
      } else {
        elasticsearch {
          user => logstash_internal
          password => "${LOGSTASH_PASS}"
          ssl => true
          cacert => '/usr/share/logstash/config/ca_cert.pem'
          hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
          manage_template => false
          index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        }
      }
    }  

In this code block you have a metrics filter that creates events, followed by a drop filter that unconditionally deletes them. You need another conditional around the drop filter that only matches the events you want dropped.

awesome that works. Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.