vector
vector copied to clipboard
Should parse errors always result in a dropped event for all sources
Some examples:
The dnstap source, if there is an error parsing the message or if the message contains an invalid data_type_id the parser will insert the entire message into the event as raw data.
This is similar to how the syslog source used to work until recently. Now this source will error and drop the event if it can't parse the message correctly.
Should all sources always drop the event on a parse error?