Hi
I need to drop a document in an ingest pipeline , ie to not index it at all, I need to do it filtering the messages by the type of severity and discard them
I am testing it in the following way
PUT _ingest/pipeline/drop_model
{
"processors": [
{
"drop": {
"if": "ctx.severity == 'info'"
}
}
]
}
The logs in kibana that I need to discard are of the type
{
"_index": "logstash",
"_type": "events",
"_id": "AWmh3Bauu--TaD0PBnfj",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2019-03-21T20:05:48.966480+00:00",
"@version": "1",
"host": "linux-009",
"severity": "info",
"facility": "user",
"tag": "updatemgr",
"pid": 0,
"msg": "2019-03-21T20:05:48:946Z 'VcIntegrity' 139793736918784 INFO [vcIntegrity, 1519] Getting IP Address from host name: linux-009"
},
"fields": {
"@timestamp": [
"2019-03-21T20:05:48.966Z"
]
},
"sort": [
1553198748966
]
}