Added filter for throttling

manifest/operations/pipelines/cf-apps-es/filter-15-throttle-logs.conf

@@ -0,0 +1,29 @@
+filter {
+
+ throttle {
+    before_count => "${THROTTLE_SAME_MESSAGE_BEFORE_COUNT}"
+    after_count => "${THROTTLE_SAME_MESSAGE_AFTER_COUNT}"
+    period => "${THROTTLE_SAME_MESSAGE_PERIOD}"
+    max_age => "${THROTTLE_SAME_MESSAGE_MAX_AGE}"
+    key => "%{[@cf][app_id]}%{[@message]}"
+    add_tag => ["throttle", "throttled_same_message"]
+  }
+
+ if "throttle_same_message" in [tags] {
+    drop { percentage => "${THROTTLE_SAME_MESSAGE_DROP_PERCENTAGE}"}
+  }
+
+  throttle {
+    before_count => "${THROTTLE_RATE_LIMIT_BEFORE_COUNT}"
+    after_count => "${THROTTLE_RATE_LIMIT_AFTER_COUNT}"
+    period => "${THROTTLE_RATE_LIMIT_PERIOD}"
+    max_age => "${THROTTLE_RATE_LIMIT_MAX_AGE}"
+    key => "%{[@cf][app_id]}"
+    add_tag => ["throttle", "exceed_rate_limit"]
+  }
+
+ if "throttled" in [tags] {
+    drop { percentage => "${THROTTLE_RATE_LIMIT_DROP_PERCENTAGE}"}
+  }
+
+}

manifest/operations/pipelines/cf-apps-es/output-15-custom-stdout.conf

@@ -0,0 +1,21 @@
+output {
+
+  if "throttled" in [tags] {
+      stdout {
+             codec => line {format => "DROP from Throttled: %{[@cf][app]} %{[@timestamp]} %{[@message]}"}
+      }
+
+  }  else if "throttle_same_message" in [tags] {
+      stdout {
+             codec => line {format => "DROP from same message: %{[@cf][app]} %{[@timestamp]} %{[@message]}"
+      }
+                     }
+
+  }  else {
+      stdout {
+             codec => line {format => "%{[@cf][app]} %{[@timestamp]} %{[@message]}"}
+      }
+  }
+
+}
+