{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/3132","labels_url":"https://api.github.com/repos/elastic/logstash/issues/3132/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/3132/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/3132/events","html_url":"https://github.com/elastic/logstash/issues/3132","id":72019322,"number":3132,"title":"[Logstash 1.5RC3] Unable to split on previously split events within same filter/conditional block","user":{"login":"thehybridtechnician","id":7101569,"avatar_url":"https://avatars.githubusercontent.com/u/7101569?v=3","gravatar_id":"","url":"https://api.github.com/users/thehybridtechnician","html_url":"https://github.com/thehybridtechnician","followers_url":"https://api.github.com/users/thehybridtechnician/followers","following_url":"https://api.github.com/users/thehybridtechnician/following{/other_user}","gists_url":"https://api.github.com/users/thehybridtechnician/gists{/gist_id}","starred_url":"https://api.github.com/users/thehybridtechnician/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thehybridtechnician/subscriptions","organizations_url":"https://api.github.com/users/thehybridtechnician/orgs","repos_url":"https://api.github.com/users/thehybridtechnician/repos","events_url":"https://api.github.com/users/thehybridtechnician/events{/privacy}","received_events_url":"https://api.github.com/users/thehybridtechnician/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/elastic/logstash/labels/unconfirmed","name":"unconfirmed","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-29T23:47:15Z","updated_at":"2015-04-30T04:04:54Z","closed_at":null,"body":"This was working in Logstash 1.5RC2\r\n\r\nLogstash 1.5RC3\r\nlogstash-filter-split (0.1.6)\r\n\r\n**Input data**\r\nfoo bar split foo bar bob foo bar ping foo bar\r\n\r\nExpected output\r\nEvent 1 - foo bar\r\nEvent 2 - foo bar\r\nEvent 3 - foo bar\r\nEvent 4 - foo bar\r\n\r\n**What doesn't work**\r\n```\r\nlogstash agent -e \"input { stdin { type => 'test' } } filter { if [type] == 'test' { mutate { gsub => [ 'message','bob','split' ] } split { terminator => 'split' } split { terminator => 'ping' } } }  output { stdout { codec => rubydebug } }\"\r\n```\r\nOutput\r\n```\r\n {\r\n        \"message\" => \"foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:37:33.047Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:37:33.047Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar ping foo bar\",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:37:33.047Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \"foo bar split foo bar split foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:37:33.047Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar\",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:37:33.047Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n```\r\n \r\n**What kinda works**\r\n```\r\nlogstash agent -e \"input { stdin { type => 'test' } } filter { if [type] == 'test' { mutate { gsub => [ 'message','bob','split' ] } split { terminator => 'split' } } } filter { if [type] == 'test' { split { terminator => 'ping' } } }  output { stdout { codec => rubydebug } }\"\r\n```\r\nOutput\r\n```\r\n {\r\n        \"message\" => \"foo bar split foo bar split foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:38:38.309Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar\",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:38:38.309Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \"foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:38:38.309Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:38:38.309Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar \",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:38:38.309Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n {\r\n        \"message\" => \" foo bar\",\r\n       \"@version\" => \"1\",\r\n     \"@timestamp\" => \"2015-04-29T23:38:38.309Z\",\r\n           \"type\" => \"test\",\r\n           \"host\" => \"0.0.0.0\"\r\n }\r\n```\r\n\r\nAny assistance would be appreciated.  Thank you!"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/97654382","html_url":"https://github.com/elastic/logstash/issues/3132#issuecomment-97654382","issue_url":"https://api.github.com/repos/elastic/logstash/issues/3132","id":97654382,"user":{"login":"wiibaa","id":659227,"avatar_url":"https://avatars.githubusercontent.com/u/659227?v=3","gravatar_id":"","url":"https://api.github.com/users/wiibaa","html_url":"https://github.com/wiibaa","followers_url":"https://api.github.com/users/wiibaa/followers","following_url":"https://api.github.com/users/wiibaa/following{/other_user}","gists_url":"https://api.github.com/users/wiibaa/gists{/gist_id}","starred_url":"https://api.github.com/users/wiibaa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wiibaa/subscriptions","organizations_url":"https://api.github.com/users/wiibaa/orgs","repos_url":"https://api.github.com/users/wiibaa/repos","events_url":"https://api.github.com/users/wiibaa/events{/privacy}","received_events_url":"https://api.github.com/users/wiibaa/received_events","type":"User","site_admin":false},"created_at":"2015-04-30T04:04:54Z","updated_at":"2015-04-30T04:04:54Z","body":"There is a bug in RC3 where cancelled events are still processed by the pipeline, should be fixed by #3110 "}}