Description
Logstash filters typically call a filter_matched method which mutates documents by adding or removing fields and/or tags upon successful completion.
eg, The documentation for add_tag in filter states:
If this filter is successful, add arbitrary tags to the event. Tags can be dynamic and include parts of the event using the %{field} syntax.
The logic behind "if this filter is successful" is somewhat open to interpretation, and is applied inconsistently across plugins; some filters will call filter_matched no matter if the filter had any effect on the incoming event, others will only call filter_matched if a lookup or mutation was applied to the event from that filter.
For example:
logstash-filter-prune will call filter_matched regardless of whether any fields were pruned from the event.
logstash-filter-mutate will call filter_matched regardless of whether any fields were mutated.
logstash-filter-grok will only call filter_matched if a match was found.
Going forward, we would like to provide a consistent, and clear determination on the use of filter_matched to mutate events appropriately after a filter has been processed.
This issue will be used to capture current behaviour of filters, and what the desired behaviour is going forward