Are processors applied to the filebeat application logs?

Elastic Stack Beats
1

I am trying to filter out some filebeat logs with drop_event processor, but it doesn't seem to work. This is the event:

{
"log.level":"warn",
"@timestamp":"2024-01-01T12:11:22.333Z",
"log.logger":"file_watcher",
"log.origin":{"function":"github.com/elastic/beats/v7/filebeat/input/filestream.(*fileWatcher).watch","file.name":"filestream/fswatch.go","file.line":205},
"message":"file \"/var/log/example.log\" has no content yet, skipping",
"service.name":"filebeat",
"ecs.version":"1.6.0"}

and i'm trying to drop it like this:

processors:
 - drop_event:
     when:
       equals:
         service.name: "filebeat"

Is my configuration syntax incorrect? Are processors even appliend to internal logs?

2

Hi,

processors might not be applied to internal logs. If you want to reduce the verbosity of Filebeat's internal logging, you can adjust the logging level in the Filebeat configuration. For example, you can set logging.level: error to only log error messages.

Regards

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.