This filter introduces a simple cache mechanism in the rule. It is a TTL based cache and it can have a local visibility (cache is only visible to the current filter) or a global visibility (cache shared across ALL the rules).
If the target of the Message as input has been cached before, and his TTL is not expired, it will be dropped and not propagated to the next filter.
Otherwise if the target of the Message is new to the cache, it is inserted in it and propagated to the next filter.
|target||STRING||“main”||the field of the Message that should be used for the filter (it could be main or and extra field)|
|refresh_on_get||BOOL||“true”||the TTL is refreshed if the key has been looked up|
|ttl||DURATION||24h||how long after the key will be deleted|
|sync_time||DURATION||5m||how often the sync on file should be called|
|name||STRING||""||named global cache: this cache will be available for ALL the rules also for different files|
|global||BOOL||“false”||make this cache global: like for the |
|file||STRING||""||enable cache persistence. It loads and writes the cache from a file|
... | cache(ttl="24h", global="true") | ...
The output is not being changed. This filter can only stop or not the propagation of the Message.