Tag drop{} statements per content-hub convention

Google's content-hub parsers tag dropped logs (drop { tag => "TAG_..." })
so they surface correctly in the unparsed-log views, rather than bare drop{}.
Use TAG_MALFORMED_ENCODING for the two JSON-extraction/parse failures (matches
content-hub) and TAG_UNSUPPORTED for valid JSON that matches no parsedmarc
report shape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-06-04 12:15:05 -04:00
parent aabcfb4298
commit e6e9369b1d
+3 -3
View File
@@ -177,7 +177,7 @@ filter {
on_error => "no_json_payload"
}
if [no_json_payload] {
drop {}
drop { tag => "TAG_MALFORMED_ENCODING" }
}
json {
@@ -185,7 +185,7 @@ filter {
on_error => "not_json"
}
if [not_json] {
drop {}
drop { tag => "TAG_MALFORMED_ENCODING" }
}
# ---------------------------------------------------------------------------
@@ -232,7 +232,7 @@ filter {
# Not a parsedmarc record we recognize: drop rather than emit an invalid event.
if [report_type] == "" {
drop {}
drop { tag => "TAG_UNSUPPORTED" }
}
# ===========================================================================