drop { }
}
- if [http_request_failure] or [@metadata][code] != "200" {
+ if [http_request_failure] or [@metadata][code] != 200 {
mutate {
add_tag => [ "error" ]
}
}
- if "dmaap_source" in [tags] {
+ if "dmaap_source" in [@metadata][request][tags] {
#
# Dmaap provides a json list, whose items are Strings containing the event
# provided to Dmaap, which itself is an escaped json.
source => "[message]"
target => "message"
}
- ruby {
- code => "
- for ev in event.get('message', [])
- ev.set('@metadata', event.get('@metadata'))
- end
- "
- }
-
+
split {
field => "message"
}
}
- if "error" not in [tags] {
+ if "error" not in [@metadata][request][tags]{
#
# Creating data for a secondary index
#
add_tag => [ "event-cl-aggs" ]
}
- if "event-cl-aggs" in [tags] {
+ if "event-cl-aggs" in [@metadata][request][tags]{
#
# we only need a few fields for aggregations; remove all fields from clone except :
# vmName,vnfName,vnfType,requestID,closedLoopAlarmStart, closedLoopControlName,closedLoopAlarmEnd,abated,nbrDmaapevents,finalFailure