I am trying drop a specific event from filebeat apache module , i have tried below drop event processor and its not working.
Event to be dropped if the
url.original field contains
refresh as the text
In the above field , only this content
refresh.defaults.notifynewmessages is static and all other contents are dynamic
I have updated filebeat.yml file to drop the event as below.
- drop_event: when: or: - contains: message: "HealthCheck" - This is working fine and event is getting dropped - contains: url.original: "refresh" - This is not working.
Do i need to update this in the ingest pipeline if so how i can do that. Please help.