elasticsearch/logstash-contrib — pull request #57 by greem (2014-05-12 09:29:39+00:00)
Title: Switch to suppress logstash errors if elasticsearch filter query fails

Using the elasticsearch filter, if a query fails (no results found or otherwise), logstash emits a handled exception into the log. For a fast-moving data stream this generates a lot of log lines.

Patch adds "fail_on_error" option to the elasticsearch filter. Default is "true" (existing behaviour). If set to "false", returns a single field on query failure:

query_failed => (original query string)

That field can then be post-processed, or removed.

Tested and in use on a multi-million message/day mail system log - see http://graemef.wordpress.com/tech-stuff/exim-logstash/ for a detailed writeup.