フリー問題

問題文

A team writes a pipeline whose Grok processor extracts a status field, then tries to scope that same pipeline to events where the extracted status is an error. Which statement describes why that scoping fails?

選択肢

1. The pipeline filter is evaluated at the entrance of the configuration, so the extracted field exists only earlier and the working filter reads an extracted attribute.
2. The pipeline filter is evaluated at the entrance of the configuration, so the extracted field exists only afterwards and the working filter reads an extracted attribute.
3. The pipeline filter is evaluated at the entrance of the configuration, so the extracted field exists only earlier and the working filter reads an incoming attribute.
4. The pipeline filter is evaluated at the entrance of the configuration, so the extracted field exists only afterwards and the working filter reads an incoming attribute.