Hello!
I've just started learning ELK and I'm having some confusion with filebeat's drop_fields processor.
My configuration:
filebeat.inputs:
- type: log
paths:
- /mnt/var/log/ovpnagent.log
fields_under_root: true
processors:
- drop_fields:
fields: ["ecs", "input", "host"]
enabled: true
Only the "input" field is dropped, while "host" and "ecs" remain. I also tried to use variants with "ecs.version" and "host.name", but nothing changed.
Can someone point me to my mistake and show me where it is explained in the documentation?