fluent-plugin-record-modifier icon indicating copy to clipboard operation
fluent-plugin-record-modifier copied to clipboard

Label support seems to have a glitch

Open TimofeyGudilin-TomTom opened this issue 3 years ago • 1 comments

It looks to me like labels are not being followed. I duplicate my log flow into two streams using labels, and the second label (@EVENTLOG.LOGICMONITOR) does not receive keys which are removed in the first label (@EVENTLOG.SCALYR) If I use "@type record_transformer" instead of "@type record_modifier" these two log flows are processed independently as expected.

<match eventlog.syslog.**>
  @type copy
  <store>
    @type relabel
    @label @EVENTLOG.SCALYR
  </store>
  <store>
    @type relabel
    @label @EVENTLOG.LOGICMONITOR
  </store>
</match>

<label @EVENTLOG.SCALYR>
  <filter eventlog.syslog.**>
    @type record_modifier
    remove_keys logline,pri,ident,severity
  </filter>
  <match eventlog.syslog.**>
    @type stdout
  </match>
</label>

<label @EVENTLOG.LOGICMONITOR>
  <filter eventlog.syslog.**>
    @type record_modifier
    <record>
      message ${record["node"]}:${record["ident"]}:${record["severity"]} ${record["logline"]}
    </record>
    remove_keys logline
  </filter>
  <match eventlog.syslog.**>
    @type stdout
  </match>
</label>

TimofeyGudilin-TomTom avatar Oct 14 '21 11:10 TimofeyGudilin-TomTom

record_modifier mutates incoming records in-place, so this behavior is expected. You need to change process order in out_copy.

<match eventlog.syslog.**>
  @type copy
  <store>
    @type relabel
    @label @EVENTLOG.LOGICMONITOR
  </store>
  <store>
    @type relabel
    @label @EVENTLOG.SCALYR
  </store>
</match>

repeatedly avatar Nov 09 '21 11:11 repeatedly