Truncate filter adds tag even if no fileds were truncated

[sarabande]

Hi,

I'm using truncate filter to truncate messages longer than 32766 bytes. In that case I'd like the tag 'truncated_message' to be added to the message.

This is how I use truncate filter in my logstash configuration:

# Truncate messages longer than 32766 bytes
truncate {
fields => "message"
length_bytes => 32766
add_tag => ["truncated_message"]
}

Logstash truncate filter documentation states: "If this filter is successful, add arbitrary tags to the event".

I can see that my messages were tagged with 'truncated_message' every time truncate filter is called, even if the messages were not truncated. I can see messages that were way much shorter than 32766 bytes tagged.

Please let me know how to use the truncate filter in order to add arbitrary tags only to messages that were truncated.

[Badger]

@sarabande

I can see that my messages were tagged with 'truncated_message' every time truncate filter is called, even if the messages were not truncated.

Correct. There is an open issue for this, but do not for a moment think it will get changed.