input plugin udp - field/tags additions leaking to other listen section

[Kaacz]

• Version: Logstash 5 Alpha 4, logstash-input-udp-3.0.1
• Operating System: last Debian Jessie
• Config File (if you have sensitive info, please remove it):
  input {
  udp {
  port => 1514
  type => syslog
  tags => ["udp1514"]
  }
  udp {
  port => 5514
  type => syslog
  add_field => [ "dev_type", "spec-dev" ]
  tags => ["udp5514"]
  }
  }
• Sample Data:
• Steps to Reproduce:
  No one packet go to port 5514 (checked via tcpdump), but cca 2000 packets in minute from port 1514 are "labeled" as going from port 5514.

[Kaacz]

Back to trees ... 'tags' is right definition ..

[jsvd]

this is a consequence of how logstash output section works
1 event will be passed through the outputs in sequence, so if one output changes the event by adding the tags, then the second output will received the modified event.

If you want to achieve this, you need to use

filter { clone { clones => ["cloned"] } }
output {
  if [type] == "cloned" {
    udp {
      port => 1514
      type => syslog
      tags => ["udp1514"]
    }
  } else {
    udp {
      port => 5514
      type => syslog
      add_field => [ "dev_type", "spec-dev" ]
      tags => ["udp5514"]
    }
  }
}