Create a new event from some fields

Elastic Stack Logstash
1

Hi,

I have a log record which looks like

{
  @timestamp: some_timestamp, 
  metadata_field: metadata_value,
  other_field: other_value,
  message: some_message
}

Is it possible to make new event from this log record which will look like

{
  metadata_field: metadata_value,
  message: some_message
}

i.e. I want to keep only message and metadata_field in a new event.

Use clone might be not a good idea because I don't know exactly what other_field could be so I can not to delete it/them.

2

A prune filter might help.

1 Like
3

@Badger thank you!
It looks hopefully