An Eventstream includes a filter step meant to drop test events generated by a branch's turnstile hardware during maintenance, keeping only real visitor scans. After the vendor updates the turnstile firmware and renames one of the fields the filter condition checks, the filter step's live preview shows every single event being dropped, including legitimate visitor scans. What has happened?
Select an answer to reveal the explanation.
Short Explanation
A filter is only as good as the field it's checking, and a renamed field is invisible to a condition written for the old name. Instead of matching "just the test events" like it used to, the filter effectively finds nothing to keep, and everything downstream just disappears — including all the real visitor scans.
Full Explanation
A filter step evaluates its condition against specific fields in the incoming event payload, and when a firmware update renames one of those fields, the condition can no longer locate the value it expects, which typically causes the filter to behave as though the condition is never satisfied for keeping events, dropping the entire stream rather than just the intended maintenance test events. This is confirmed directly by the scenario's detail that the live preview at the filter step shows zero events passing through, which points squarely at the filter's own logic rather than anything upstream or downstream of it. An Eventhouse destination rejecting events would show data still flowing through the Eventstream's own nodes up to the destination, with the drop occurring after the filter, not at it. Turnstiles ceasing to send events entirely would show zero volume at the source node itself, not just at the filter step. Exhausted compute capacity typically produces processing delays, backpressure, or throttling symptoms across the whole Eventstream, not a clean all-or-nothing drop isolated to one filter condition. The concrete fix path is to update the filter condition to reference the new field name from the updated firmware, then confirm in the live preview that only the intended test events are being excluded again.