Drop agent / ecs fields from filebeat (previous solves here only partially work)

Elastic Stack Beats
1

Hey all,

I'm attempting to use filebeat to send documents into ES, however even though I've got a processor set up to drop fields, some are still stubbornly getting sent.

in my filebeat.yml file:

- drop_fields:
          fields: ["message", "decoded", "agent.ephmeral_id", "agent.hostname", "agent.id", "agent.name", "agent.name", "agent.type", "agent.version", "ecs.version", "host.name", "input.type", "log.file.path"]

I know that drop_fields is working because it's dropping some of those fields, but the agent.*, ecs.version, and host.name persist.

I double checked and all of the "add_*_metadata" processors are commented out later on in the file. Is there some newer trick required to remove those fields now? I'm running a 7.x version of filebeat at the moment.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.