Drop events if a field does not exist

Elastic Stack Beats
1

I would like drop events if a field does not exist in the doc.
will the drop_events config help here?

2

You could try the regex condition. It would keep every event if your.field contains anything.

processors:
 - drop_event:
       when:
           not:
               regexp:
                   your.field: ".*"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.