Hi,
I am using Logstash 1.4.2.
When we do add_tag in multiline filter, it seems like it is not adding any tag.
Following is my logstash conf:
filter {
grok {
match => { "message" => "^Start Line.*" }
add_field => { "header" => " " }
add_field => { "first" => " " }
add_field => { "last" => " " }
}
multiline {
pattern => "^line.*|^$"
what => "previous"
add_tag => [ "isHeader" ]
}
if "isHeader" in [tags] {
mutate {
update => [ "header", "%{header}%{message}" ]
update => [ "message", " " ]
}
}
}
Please let me know how add_tag is different from other filters.
Thanks.