elasticsearch/logstash — pull request #1795 by jsvd (2014-09-27 22:08:54+00:00)
Title: Fix add_tag behaviour in dns filter #1785

The filter should only modify the event's fields and tags if and only if
all resolves/reverses succeed. So we clone the event, modify the new
copy and return it if all operations succeed. Otherwise the original
event is not modified.

For performance reasons we could reverse the clone logic: clone the
event, modify the original event and, it case of failure, return the
backup.

Note: this changes the dns filter behaviour towards `add_tag`