-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
It looks to me like labels are not being followed.
I duplicate my log flow into two streams using labels,
and the second label (@EVENTLOG.LOGICMONITOR) does not receive keys which are removed in the first label (@EVENTLOG.SCALYR)
If I use "@type record_transformer" instead of "@type record_modifier" these two log flows are processed independently as expected.
<match eventlog.syslog.**>
@type copy
<store>
@type relabel
@label @EVENTLOG.SCALYR
</store>
<store>
@type relabel
@label @EVENTLOG.LOGICMONITOR
</store>
</match>
<label @EVENTLOG.SCALYR>
<filter eventlog.syslog.**>
@type record_modifier
remove_keys logline,pri,ident,severity
</filter>
<match eventlog.syslog.**>
@type stdout
</match>
</label>
<label @EVENTLOG.LOGICMONITOR>
<filter eventlog.syslog.**>
@type record_modifier
<record>
message ${record["node"]}:${record["ident"]}:${record["severity"]} ${record["logline"]}
</record>
remove_keys logline
</filter>
<match eventlog.syslog.**>
@type stdout
</match>
</label>
Metadata
Metadata
Assignees
Labels
No labels