Invalidation Errors
There are two reasons that a message will be marked as invalid. Either the parser fails its global validation or the parser fails the validation function.
- Parser fails global validation
-
The global configuration validates messages coming from all parsers. This is done in the form of validation plugins where assertions about fields or whole messages can be made. For more information about defining fieldValidations, see Create Global Configurations.
- Parser fails the validation function
- If a parser fails the validation function, this typicallyi means it does not have a
timestamp
field ororiginal_string
field.
There are two types of events. One, where the event could not be parsed at all. Two, where the event was parsed, but failed validation.