fluent-plugin-record-modifier
fluent-plugin-record-modifier copied to clipboard
Label support seems to have a glitch
It looks to me like labels are not being followed. I duplicate my log flow into two streams using labels, and the second label (@EVENTLOG.LOGICMONITOR) does not receive keys which are removed in the first label (@EVENTLOG.SCALYR) If I use "@type record_transformer" instead of "@type record_modifier" these two log flows are processed independently as expected.
<match eventlog.syslog.**>
@type copy
<store>
@type relabel
@label @EVENTLOG.SCALYR
</store>
<store>
@type relabel
@label @EVENTLOG.LOGICMONITOR
</store>
</match>
<label @EVENTLOG.SCALYR>
<filter eventlog.syslog.**>
@type record_modifier
remove_keys logline,pri,ident,severity
</filter>
<match eventlog.syslog.**>
@type stdout
</match>
</label>
<label @EVENTLOG.LOGICMONITOR>
<filter eventlog.syslog.**>
@type record_modifier
<record>
message ${record["node"]}:${record["ident"]}:${record["severity"]} ${record["logline"]}
</record>
remove_keys logline
</filter>
<match eventlog.syslog.**>
@type stdout
</match>
</label>
record_modifier
mutates incoming records in-place, so this behavior is expected.
You need to change process order in out_copy
.
<match eventlog.syslog.**>
@type copy
<store>
@type relabel
@label @EVENTLOG.LOGICMONITOR
</store>
<store>
@type relabel
@label @EVENTLOG.SCALYR
</store>
</match>