logstash/logstash — pull request #439 by MattiaBeast (2013-04-10 14:36:23+00:00)
Title: New filter plugin "Advisor"

The filter Advisor is was designed for two important tasks.
The first job is to collect the events who match a grok word, store it in a buffer and release them after a time_adv time in event form. You can manipulate the result with another filter or with outputs, the result of work is signed by tags "advisor_data".
The second job is to generate other events who explain the number of event that match in time_adv time. Is useful if you want to know and manipulate information on outputs of particular events, they are signed by tags "advisor_info".
A good example is when you want to regard how much events matched after every time_adv and send via mail or sns the informations.