TheVastyDeep
TheVastyDeep
[PR 12899](https://github.com/elastic/logstash/pull/12899) modified the best-practice doc to [add](https://github.com/elastic/logstash/blob/main/docs/static/best-practice.asciidoc#check-to-see-if-a-boolean-field-exists) a way to test whether a boolean field exists by using mutate+add_field to add a static value to [@metadata] and then use...
The compiler [raises an exception](https://github.com/elastic/logstash/blob/0605b75420f9723e13ab694b01cb98efdc3d196d/logstash-core/lib/logstash/compiler.rb#L32) when there is a syntax error in the configuration. I realize that a lot of code passes "null" for source_with_metadata, but if SourceWithMetadata.protocol is "file"...
In 7.13 the documentation for the file_chunk_count states "Default value is 4611686018427387903". This is not true. The [default](https://github.com/logstash-plugins/logstash-input-file/blob/9be8dc26356c40050a06b074acf33d009fecf90e/lib/filewatch/bootstrap.rb#L14) is 4611686018427387903/32768. That is, 140737488355327. Also this assumes a 64-bit JVM.
For Content-Type `application/json` the `json` codec is used by default. That is helpful, but with the introduction of ECS it creates an issue. If the target option on the codec...
The [toString method](https://github.com/elastic/logstash/blob/9bc2496e7b9dcc2ef05e805a308eb726dd8427c3/logstash-core/src/main/java/org/logstash/Event.java#L375) in Event.java looks for [host] on the event. But with ECS the event will usually have a [host][name] field. That means you get "{name=foo}" in the output...
logstash 8.8.1 installed on Linux via RPM and run on the command line. aggregate is bundled with the RPM. Bundled JVM used. If the timeout_timestamp_field is missing from an event...
- Version: 7.1.1 - Operating System: AWS Linux - Config File (if you have sensitive info, please remove it): ``` input { generator { count => 1 lines => [...
PR [12051](https://github.com/elastic/logstash/pull/12051) added the ability to substitute a list of URIs from an environment variable. It specifically mentions it would be useful for the hosts option in ES Input/Filter/Output plugins....
logstash 7.15.2, installed using yum, run from the command line. The following configuration input { generator { count => 1 lines => [ '' ] } } output { udp...
If the source field does not exist most filters (csv, date, grok, kv) are a no-op. They silently do nothing. The geoip adds the lookup failure tag. I think that...