Add check for split_traffic

redBorder · Jan 23, 2025 · 9e7fc82 · 9e7fc82
1 parent 9171f2d
commit 9e7fc82
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/resources/templates/default/sflow_normalization.conf.erb b/resources/templates/default/sflow_normalization.conf.erb
@@ -83,9 +83,11 @@ filter {
   }
 
   # Set observation_id: (if 4294967295 -> "default")
-  if [tag2] and [tag2] != 4294967295 {
-    mutate { replace =>  { "observation_id" => "%{tag2}" } }
-  }
+  <% if @split_traffic_logstash %>
+    if [tag2] and [tag2] != 4294967295 {
+      mutate { replace =>  { "observation_id" => "%{tag2}" } }
+    }
+  <% end %>
 
   # Set timestamp, bytes and application_id_name  
   ruby { code => " event.set('timestamp', event.get('@timestamp').to_i);