Hey all,
I'm attempting to use filebeat to send documents into ES, however even though I've got a processor set up to drop fields, some are still stubbornly getting sent.
in my filebeat.yml file:
- drop_fields:
fields: ["message", "decoded", "agent.ephmeral_id", "agent.hostname", "agent.id", "agent.name", "agent.name", "agent.type", "agent.version", "ecs.version", "host.name", "input.type", "log.file.path"]
I know that drop_fields is working because it's dropping some of those fields, but the agent.*, ecs.version, and host.name persist.
I double checked and all of the "add_*_metadata" processors are commented out later on in the file. Is there some newer trick required to remove those fields now? I'm running a 7.x version of filebeat at the moment.