Don't drop event postgresql.activity.query

Elastic Stack Beats
1

Hello guys,

I'm using metricbeat to collect metrics from postgresql, via the postgresql module.

I need to drop events with:

  • postgresql.activity.query: "COMMIT"
  • postgresql.activity.query: ""

In the metrcibeat configuration I have:

   - drop_event:
       when:
         or:
           - regexp:
               postgresql.activity.query.text: "^SET.*"
           - regexp:
               postgresql.statement.query: "^COMMIT.*"
           - regexp:
               postgresql.statement.query.text: "^COMMIT.*"
           - equals:
               postgresql.activity.query.text: ""
           - equals:
               postgresql.activity.query: ""

Only events with postgresql.activity.query are not dropped. The rest are working.

I tried to configure to drop only the events with:

   - drop_event:
       when:
         or:
           - regexp:
               postgresql.statement.query: "^COMMIT.*"
           - equals:
              postgresql.activity.query: ""

It also didn't work. I also configured with equals instead of regexp, to no avail.

Does anyone know how to solve?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.