1 files changed, 5 insertions, 12 deletions

diff --git a/kubernetes/clamp/charts/clamp-dash-logstash/resources/config/pipeline.conf b/kubernetes/clamp/charts/clamp-dash-logstash/resources/config/pipeline.conf
index 317b428c77..b4b5071ba5 100644
--- a/kubernetes/clamp/charts/clamp-dash-logstash/resources/config/pipeline.conf
+++ b/kubernetes/clamp/charts/clamp-dash-logstash/resources/config/pipeline.conf
@@ -57,13 +57,13 @@ filter {
         drop { }
     }
 
-    if [http_request_failure] or [@metadata][code] != "200" {
+    if [http_request_failure] or [@metadata][code] != 200 {
        mutate {
        	   add_tag => [ "error" ]
        }
     }
 
-    if "dmaap_source" in [tags] {
+    if "dmaap_source" in [@metadata][request][tags] {
         #
         # Dmaap provides a json list, whose items are Strings containing the event
         # provided to Dmaap, which itself is an escaped json.
@@ -76,14 +76,7 @@ filter {
             source => "[message]"
             target => "message"
         }
-        ruby {
-            code => "
-            for ev in event.get('message', [])
-                ev.set('@metadata', event.get('@metadata'))
-            end
-            "
-        }
-    	
+
         split {
             field => "message"
         }
@@ -194,7 +187,7 @@ filter {
     }
 
 
-    if "error" not in [tags] {
+    if "error" not in [@metadata][request][tags]{
         #
         # Creating data for a secondary index
         #
@@ -203,7 +196,7 @@ filter {
             add_tag => [ "event-cl-aggs" ]
         }
         
-        if  "event-cl-aggs" in [tags] {
+        if  "event-cl-aggs" in [@metadata][request][tags]{
             #
             # we only need a few fields for aggregations; remove all fields from clone except :
             #   vmName,vnfName,vnfType,requestID,closedLoopAlarmStart, closedLoopControlName,closedLoopAlarmEnd,abated,nbrDmaapevents,finalFailure