Issue with elasticsearch ingest pipeline drop processor

1
votes

I have an elasticsearch ingest pipeline to ingest logs however I want to drop the document if it contains a certain string in the message field. I am trying to use the drop processor for this but the document does not seem to get dropped.

I have the following drop processor:

"drop": {
               "if" : "ctx.message == '(^commit{dir=.+)'"
            },

I am expecting this to drop any document with a matching expression in the message field but this is not happening. Am I misunderstanding how this processor works?

Thanks

1
elasticsearch

1 Answers

1
votes

Ok, so after much googling I found this https://github.com/elastic/elasticsearch/issues/36150

This is a known bug which is fixed in 7.4