Hello,
I send different types of logs from filebeat directly to ES and I have noticed in kibana discover tab that my some logs have empty fields which they are used by other log entries. For example, my production log entries have fields like :
aws.cloudtrail.user_identity.session_context.creation_date
cef.extensions.fileCreateTime
which as I can understand are,module fields, but I never activated those modules.
Can you suggest me the correct way to drop them, or to disable from being generated?