Sprintf format doesn't work in clone filter


(Thomas) #1

Hi.

To keep the type of an event when it is cloned, I wantet to use

clone { clones => [ "%{type}_cloned" ]  }

and end up with an type %{type}_cloned instead of my_type_cloned.

Is this a bug or a feature?

You can try this config to repoduce it on the command line:

-e 'filter { clone { clones => [ "foo_%{host}"] add_tag => "%{host}"} }'

The tags should contain your hostname while the type stays foo_%{host}.

How can I keep the type even in cloned events? Tagging it is good enough for me.


(system) #2