Drop_fields

[y34rz3r0]

Hello!

I've just started learning ELK and I'm having some confusion with filebeat's drop_fields processor.

My configuration:

filebeat.inputs:
  - type: log
    paths:
      - /mnt/var/log/ovpnagent.log
    fields_under_root: true
    processors:
      - drop_fields:
          fields: ["ecs", "input", "host"]
    enabled: true

Only the "input" field is dropped, while "host" and "ecs" remain. I also tried to use variants with "ecs.version" and "host.name", but nothing changed.

Can someone point me to my mistake and show me where it is explained in the documentation?

[y34rz3r0]

Okay, my mistake was that some fields are added later than processing, so a global processor is needed.

Like this:

filebeat.inputs:
  - type: log
    paths:
      - /mnt/var/log/ovpnagent.log
    fields_under_root: true
    enabled: true

processors:
  - drop_fields:
      fields: ["ecs", "input", "host"]

[stephenb (Stephen Brown)]

@y34rz3r0 Welcome to the community! and thanks for posting your solution.