Drop cdrom field

Elastic Stack Logstash
1

hi,
trying to omit messages with system filesystem type of cdrom.
My filter is as per below but seems to not work. They are still showing up in Kibana.

Any help would be appreciated.
thanks

filter {
if ([indexname] == "metricbeat-win" and [system.filesystem.type ] == "cdrom" )
{
drop { }
}
}

2

Question moved to #logstash

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.