Custom Logs integration, drop_fields processor doesn't work

Elastic Stack Elastic Agent
1

Hi everyone,
I'm trying get a drop_fields processor working inside Custom Logs integration in Elastic Agent.
This is my configuration in the "processors" text area in the integration page on kibana.

- drop_fields:
    fields:
    - host.id

The same exact conguration is working with vanilla filebeat.
I tried to put everything under "Custom configurations" with a processors: tag and to strip the fields to just a simple single field but it is not working.

This is my complete configuration

$ elastic-agent inspect output --output default --program filebeat

[default] filebeat:
filebeat:
  inputs:
  - exclude_lines:
    - ***
    id: ***
    index: ***
    meta:
      package:
        name: log
        version: 1.1.0
    name: ***
    package_policy_id: 0e083012-7e9e-4243-b820-7e9034974aac
    paths:
    - ***
    pipeline: ***
    processors:
    - add_fields:
        fields:
          input_id: logfile-logs-0e083012-7e9e-4243-b820-7e9034974aac
        target: '@metadata'
    - drop_fields:
        fields:
        - host.id
    - add_fields:
        fields:
          dataset: ***
          namespace: production
          type: logs
        target: data_stream
    - add_fields:
        fields:
          dataset: ***
        target: event
    - add_fields:
        fields:
          stream_id: logfile-log.log-0e083012-7e9e-4243-b820-7e9034974aac
        target: '@metadata'
    - add_fields:
        fields:
          id: 0133b77a-1244-49a5-98cb-466affd757c4
          snapshot: false
          version: 8.5.0
        target: elastic_agent
    - add_fields:
        fields:
          id: 0133b77a-1244-49a5-98cb-466affd757c4
        target: agent
    revision: 12
    type: log
output:
  elasticsearch:
    api_key: ***
    hosts:
    - https://***:9200
    - https://***:9200
    - https://***:9200
    - https://***:9200
    - https://***:9200
    - https://***:9200
    - https://***:9200
    - https://***:9200
    - https://***:9200
    ssl:
      certificate_authorities:
      - ***

I couldn't find anything relevant in the log files.

Thanks for helping out.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.