feat: Grok action will now only remove the field if grok parsing was …

…successful
driskell · Apr 5, 2023 · 676225e · 676225e
1 parent fba6388
commit 676225e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lc-lib/processor/actiongrok.go b/lc-lib/processor/actiongrok.go
@@ -81,6 +81,7 @@ func (g *grokAction) Process(evnt *event.Event) *event.Event {
 				continue
 			}
 			evnt.AddError("grok", fmt.Sprintf("Grok failure: %s", err))
+			return evnt
 		}
 		if g.Remove {
 			_, err := evnt.Resolve(g.Field, event.ResolveParamUnset)