event.original in splitted events
Open
- Dominant language
- Python
- Stars
- 1.1k
- Forks
- 455
- Avg merge
- 17h 8m
- Merged PRs (30d)
- 5
Description
I noticed there is no official solution to handle event.original in case of splitted events. If Logstash splits the event (split filter), the event.original field can be duplicated to many events. This makes hard for further integrity checks or reindexing or ... So there should be some special field for keeping "number of splits or number of copies". Or just tag like "splitted.copy"?
Contributor guide
Assessment
This issue has not been assessed yet.