Keep original message in all cases

[philhagen]

before parsing anything, keep original message - probably in a non-analyzed string

[philhagen]

This should also enable a "reprocess" option, where old messages are re-parsed with new configuration files. Possibly a process such as the following running as a cron or manually-trigger script:

• Tag all events with "_reparse"
• For all events tagged "_reparse":
  • Use elasticsearch input to re-parse messages against original field content
  • Potentially keep any existing GeoIP and ASN fields
  • Update records in elasticsearch output, updating record 'version' (Optionally delete original via a command-line switch or configuration option)
  • Remove "_reparse" tag if needed? If a new record is created, it would not have the tag, so this may not be needed

[philhagen]

this is sufficiently met with the event.original field. reprising existing records is not anticipated at this time, but can be revisited in the future.