logstash/logstash — pull request #405 by piavlo (2013-03-16 17:23:30+00:00)
Title: add alternative tags on grokparsefailure

Sometimes adding "_grokparesfailre" is not what we want, we want one or more alternative tag names for more fine grained filtering control in the pipeline.
"_grokparesfailre" is still the default.

filter {
grok {
tags => [ "apache-accesslog" ]
patterns_dir => [ "/opt/logstash/patterns" ]
match => [ "bytes", "%{IP}" ]
break_on_match => true
named_captures_only => true
tag_on_failure => [ "_bad_clientip" ]
}
}