Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Label support seems to have a glitch #62

Open
TimofeyGudilin-TomTom opened this issue Oct 14, 2021 · 1 comment
Open

Label support seems to have a glitch #62

TimofeyGudilin-TomTom opened this issue Oct 14, 2021 · 1 comment

Comments

@TimofeyGudilin-TomTom
Copy link

TimofeyGudilin-TomTom commented Oct 14, 2021

It looks to me like labels are not being followed.
I duplicate my log flow into two streams using labels,
and the second label (@EVENTLOG.LOGICMONITOR) does not receive keys which are removed in the first label (@EVENTLOG.SCALYR)
If I use "@type record_transformer" instead of "@type record_modifier" these two log flows are processed independently as expected.

<match eventlog.syslog.**>
  @type copy
  <store>
    @type relabel
    @label @EVENTLOG.SCALYR
  </store>
  <store>
    @type relabel
    @label @EVENTLOG.LOGICMONITOR
  </store>
</match>

<label @EVENTLOG.SCALYR>
  <filter eventlog.syslog.**>
    @type record_modifier
    remove_keys logline,pri,ident,severity
  </filter>
  <match eventlog.syslog.**>
    @type stdout
  </match>
</label>

<label @EVENTLOG.LOGICMONITOR>
  <filter eventlog.syslog.**>
    @type record_modifier
    <record>
      message ${record["node"]}:${record["ident"]}:${record["severity"]} ${record["logline"]}
    </record>
    remove_keys logline
  </filter>
  <match eventlog.syslog.**>
    @type stdout
  </match>
</label>
@repeatedly
Copy link
Owner

record_modifier mutates incoming records in-place, so this behavior is expected.
You need to change process order in out_copy.

<match eventlog.syslog.**>
  @type copy
  <store>
    @type relabel
    @label @EVENTLOG.LOGICMONITOR
  </store>
  <store>
    @type relabel
    @label @EVENTLOG.SCALYR
  </store>
</match>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants