vector icon indicating copy to clipboard operation
vector copied to clipboard

Should parse errors always result in a dropped event for all sources

Open StephenWakely opened this issue 3 years ago • 0 comments

Some examples:

The dnstap source, if there is an error parsing the message or if the message contains an invalid data_type_id the parser will insert the entire message into the event as raw data.

This is similar to how the syslog source used to work until recently. Now this source will error and drop the event if it can't parse the message correctly.

Should all sources always drop the event on a parse error?

StephenWakely avatar Sep 15 '22 13:09 StephenWakely