In the Fluentd config file I have a configuration as such
<match a.b.**.stag>
and below it there is another match tag as follows
<match a.b.c.d.**>
Now as per documentation ** will match zero or more tag parts. However I am a bit suspicious that whether the second tag will ever be matched or the event will gobbled up by first <match> itself. What I want to confirm is that the first tag will match the events which would have otherwise matched second event or not?
The targeted events for second match do NOT have stag in them
but rest of the things are same as the first match tag target events.
What I want to confirm is that the first tag will match the events which would have otherwise matched second event or not?
It really depends on the input, so: No, this is not the case in general.
+--------------+------------------------+-----------------------+
| Tag | Matched by a.b.**.stag | Matched by a.b.c.d.** |
+--------------+------------------------+-----------------------+
| a.b.c.stag | X | |
| a.b.c.d.stag | X | X |
| a.b.c.d.e | | X |
| a.b.c.stag.e | | |
+--------------+------------------------+-----------------------+
As a general rule though, define wide matches after tight matches.
If you need a match to rule out specific tags that should not be accepted by a following tighter match (e.g. if you don't want your second match to contain any tags with stag), consider using pattern lists:
<match a.b.c.stag a.b.d.stag>
or pattern combinations:
<match a.b.{c,d.*}.stag>
These are just examples since I don't know the scope of all possible tags.