Delete default tag


(Petar) #1

I was searching for this porblem but I don`t find resolved.
On my every log in Logstash I have tag "beats_input_codec_plain_applied".

I`m add some my tags and this tag is very confusing.
Tag is my very important field and I want to delete this. How can I do this ?

I am use ELK stack.


(Mick Brennan) #2

Try this:

filter {
    if "beats_input_codec_plain_applied" in [tags] {
        mutate {
            remove_tag => ["beats_input_codec_plain_applied"]
        }
    }
}

(iyaozhen) #3

I have this problem too.

I think you kan set filebeat fields_under_root: false or change add field name.


(Petar) #4

Yes, thank you. This help me.


(Harvey Wang) #5

在哪里设置? 说明白啊
Where to set up?