diff --git a/lib/logstash/codecs/fluent.rb b/lib/logstash/codecs/fluent.rb index 92175f3..dfaaf8d 100644 --- a/lib/logstash/codecs/fluent.rb +++ b/lib/logstash/codecs/fluent.rb @@ -72,7 +72,7 @@ def decode_event(data, &block) map = entry[1] event = LogStash::Event.new(map.merge( LogStash::Event::TIMESTAMP => LogStash::Timestamp.at(epochtime), - "tags" => [ tag ] + "tags" => map.has_key?("tags") ? map["tags"] + [ tag ] : [ tag ] )) yield event end @@ -83,7 +83,7 @@ def decode_event(data, &block) map = entry[1] event = LogStash::Event.new(map.merge( LogStash::Event::TIMESTAMP => LogStash::Timestamp.at(epochtime), - "tags" => [ tag ] + "tags" => map.has_key?("tags") ? map["tags"] + [ tag ] : [ tag ] )) yield event end @@ -93,7 +93,7 @@ def decode_event(data, &block) map = data[2] event = LogStash::Event.new(map.merge( LogStash::Event::TIMESTAMP => LogStash::Timestamp.at(epochtime), - "tags" => [ tag ] + "tags" => map.has_key?("tags") ? map["tags"] + [ tag ] : [ tag ] )) yield event else diff --git a/spec/codecs/fluent_spec.rb b/spec/codecs/fluent_spec.rb index c85cd1f..49d5b83 100644 --- a/spec/codecs/fluent_spec.rb +++ b/spec/codecs/fluent_spec.rb @@ -38,6 +38,7 @@ it "should decode without errors" do subject.decode(message) do |event| expect(event.get("name")).to eq("foo") + expect(event.get("tags")).to eq("mytag") end end @@ -63,6 +64,7 @@ subject.decode(message) do |event| expect(event.get("name")).to eq("foo") + expect(event.get("tags")).to eq("mytag") count += 1 end