logstash/logstash — pull request #673 by shadyabhi (2013-09-27 10:06:25+00:00)
Title: Fix prefix and include exclude keys related bug

Hi, the current master has a bug where if `prefix` & `include_keys/exclude_keys` options are used together, the fields are not added at all.

This happens because the condition of whether to add a field or not is checked after adding the prefix. `key = event.sprintf(@prefix) + key `

A simple config like:

`filter {
kv {
source => "message"
trim => "<>:,\n "
value_split => "="
prefix => "fields."
include_keys => [ "from" , "size"]
}
}`
explains what I'm talking about. I've also written failing test which can be used to confirm the issue.

With master, for input as

`msgid=<37090f4407ac3d46bf4e53e61281484f@abc.com> from= size=471241: stored mail into mailbox 'INBOX''`,

output is

`{
"message" => "msgid=<37090f4407ac3d46bf4e53e61281484f@abc.com> from= size=471241: stored mail into mailbox INBOX",
"@timestamp" => "2013-09-27T10:06:43.275Z",
"@version" => "1",
"type" => "syslog",
"host" => "127.0.0.1:38390"
}`