Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
None
-
None
Description
At the moment, with the GrokReader, there are two options when a message does not match the grok expression:
- append - this will append the message to the previous one
- skip - this will completely skip the message
This improvement is to add a third option "raw" that will keep the message and will generate a record with only null fields and the _raw field with the raw message.
Attachments
Issue Links
- links to