João Duarte
João Duarte
since version 3.0.0 this plugin tags a failed lookup with `tag_on_failure`. However this tagging does not differentiate between a failed lookup for a private ip (which will always fail and...
Migrated from : https://logstash.jira.com/browse/LOGSTASH-631 ``` Rails production.log has two empty lines in between each event. My multiline filter with pattern "\n\n" is not matching and I know for sure I...
After a json document is serialized, a [check](https://github.com/logstash-plugins/logstash-filter-json/blob/master/lib/logstash/filters/json.rb#L78-L83) is performed on `event.timestamp` and if it's a String it's converted into a LogStash::Timestamp. However if the conversion fails the event be...
Currently (up to 8.14.0 at the moment of writing), the PipelineBus class [has a lock on the sender output](https://github.com/elastic/logstash/blob/v8.13.4/logstash-core/src/main/java/org/logstash/plugins/pipeline/PipelineBus.java#L53-L58): ```java public void sendEvents(final PipelineOutput sender, final Collection events, final boolean...
Currently mutate filter performs multiple mutations: ``` filter { mutate { rename => { .. } convert => { .. } gsub => { .. } } } ``` However...
set a default value if the field exists but the value is null. proposed syntax: ``` filter { mutate { coerce => { "field1" => 0 "field2" => "default string"...
similar to https://github.com/elastic/logstash/commit/fedcf58c4888c959ce1f7f7e6cec3b457fd16eb8
This is a PoC PR for allowing a pipeline to only reload the part of the PipelineIR after the QueueVertex if only the filters and/or outputs have changed. This would...
Currently there's a [MAX_INFLIGHT_WARN_THRESHOLD = 10_000](https://github.com/elastic/logstash/blob/master/logstash-core/lib/logstash/pipeline.rb#L154) constant that is used to signal the user if it's likely that too many events will be in memory, and the formula is: `max_inflight...