Invalidation Errors

There are two reasons that a message will be marked as invalid. Either the parser fails its global validation or the parser fails the validation function.

Parser messages that are marked as invalid are sent to the error queue with an indication that they are invalid in the error message.

Parser fails global validation: The global configuration validates messages coming from all parsers. This is done in the form of validation plugins where assertions about fields or whole messages can be made. For more information about defining fieldValidations, see Create Global Configurations.
Parser fails the validation function: If a parser fails the validation function, this typicallyi means it does not have a timestamp field or original_string field.

There are two types of events. One, where the event could not be parsed at all. Two, where the event was parsed, but failed validation.