elastic / elastic/logstash

Consistent usage of `decorate(event)` in logstash plugins

Open
#6,581 2 comments 2 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
1d 4h
Merged PRs (30d)
88

Description

While working with [logstash-input-unix](https://github.com/logstash-plugins/logstash-input-unix) I observed that some of the fields I added in `add_field` where not set to the value I defined. A quick sight into the source code revealed, that the received event is first decorated and afterward the value for the fields `host` and `path` are set (https://github.com/logstash-plugins/logstash-input-unix/blob/master/lib/logstash/inputs/unix.rb#L84-L86).

After consulting some other plugins, I observed, that the usage of `decorate(event)` is not consistent throughout the logstash plugin eco system. I found at least 3 different ways how it is handled (see below for examples). If and when yes in what way this should be changed to be consistent.

I am in favor of variant 1 and will provide a PR for [logstash-input-unix](https://github.com/logstash-plugins/logstash-input-unix).

**1. decorate as last instruction prior to enqueuing**

* [logstash-input-tcp](https://github.com/logstash-plugins/logstash-input-tcp/blob/master/lib/logstash/inputs/tcp.rb#L191)
* [logstash-input-file](https://github.com/logstash-plugins/logstash-input-file/blob/master/lib/logstash/inputs/file.rb#L320)
* [logstash-input-zeromq](https://github.com/logstash-plugins/logstash-input-zeromq/blob/master/lib/logstash/inputs/zeromq.rb)

**2. decorate, add fields afterwards if not present**

* [logstash-input-stdin](https://github.com/logstash-plugins/logstash-input-stdin/blob/master/lib/logstash/inputs/stdin.rb#L39-L40)
* [logstash-input-udp](https://github.com/logstash-plugins/logstash-input-udp/blob/master/lib/logstash/inputs/udp.rb#L119-L120)

**3. decorate, add fields afterwards**

* [logstash-input-exec](https://github.com/logstash-plugins/logstash-input-exec/blob/master/lib/logstash/inputs/exec.rb#L78-L80)
* [logstash-input-unix](https://github.com/logstash-plugins/logstash-input-unix/blob/master/lib/logstash/inputs/unix.rb#L84-L86)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.