Metric and drop filter not working together

Elastic Stack Logstash
1

Hi,

I would like throttle events using the logstash-filter-throttle plugin. After that to create a logstash-filter-metric to push it to prometheus using graphite exporter. And finally drop the events that are marked by the throttle plugin.
The issue I face is when I use de drop plugin the metric event does not get created.
Is there way to have both the drop filter and metric filter coexist?

filter {
        throttle {
          id => "main_throttle_filter"
          enable_metric => true
          before_count => -1
          after_count => 50
          period => 60
          max_age => 120
          key => "%{[fields][platform]}"
          add_tag => "throttled_events"
        }

        if "throttled_events" in [tags] {
          metrics {
            id => "throttled_metrics"
            meter => "logstash_throttled_total.%{[fields][platform]}"
            rates => []
            add_tag => "throttled_metrics"
            flush_interval => 30
            ignore_older_than => 120
          }

          drop {
            id => my_throttled_events_drop
          }
        }

    output {
      if "throttled_metrics" in [tags] {
        graphite {
          host => "${GRAPHITE_HOST}"
          port => "${GRAPHITE_PORT}"
          fields_are_metrics => true
        }
      } else {
        elasticsearch {
          user => logstash_internal
          password => "${LOGSTASH_PASS}"
          ssl => true
          cacert => '/usr/share/logstash/config/ca_cert.pem'
          hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
          manage_template => false
          index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        }
      }
    }
2

In this code block you have a metrics filter that creates events, followed by a drop filter that unconditionally deletes them. You need another conditional around the drop filter that only matches the events you want dropped.

3

awesome that works. Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.