Drop fields from Apache2 module

[Mikael_VERO]

Hi,

I have an issue I am strugling with since some times and I can't find anything on this forum.
I hope you'll be able to help me since i'm desperate.

I am trying to drop some fields from the apache2 module of filebeat.
See below an example of my module config (/etc/filebeat/modules.d/apache2.yml):

    - module: apache2
      access:
        enabled: true
        var.paths: ["/var/log/api_front-access.log"]
        processors:
            - drop_fields:
                fields: ["access.user_agent.device"]
      error:
        enabled: false
        var.paths: ["/var/log/api_front-error.log"]

Thank you!!

[steffens (Steffen Siering)]

Modules do not parse content in beats, but in Ingest Node. The file defining the ingest node pipeline can be found in the filebeats module directory apache2/access/ingest/default.json.

One can modify the pipeline definition. But so to not loose changes to the module when updating filebeat, better copy the apache2 module definition as is into myapache2 and modify the ingest node definition to remove the access.user_agent.device field.

One can configure the path of module definitions in filebeat. Alternatively to cloning the module, copy the definitions, change the path to your copy, adapt the apache2 module. Afterwards remove the old apache2 access ingest pipeline so to force a reinstall of the pipeline.

[Mikael_VERO]

Hi,

Thank you for your response.

Ok I will try this solution.
I thought that this was possible because I did the same thing in metricbeat system module and it worked perfectly.