Delay event processing | View post | Log collection solutions

LukeOrins 3 years ago

Hi everyone! I`m trying to delay an event processing for a second, i.e.: if an event has a description I'll delay the output for a period. I found the sleep method in the Documentation, but it's not working as intended. Below is how my input is configured:

<Input input_file>
    Module            im_file
    File            "%LOGPATH%"
    ReadFromLast            TRUE
    Recursive            FALSE
	
	<Exec>
        if ($raw_event =~ /UPDATE/)
        {
            parse_json();
        }
        else if ($raw_event =~ /DELETE/)
        {
            sleep(2000) # wait 2 seconds before processing this event
            parse_json();
        }
    </Exec>
</Input>

Is is possible to delay/wait for a few seconds before processing an event?

Thank you in advance!