I'd like to drop the beat fields. I've used the formal docs and added the processors part but the fields are still in the data for some reason. What am I doing wrong?
This is my yaml file for metricbeat 5.5.0:
metricbeat.modules: - module: system metricsets: ["process"] filters: - drop_event.when.regexp.name: '(bioset|python|sshd|bash|sftp-server|atop|java|cron|acpi_thermal_pm|agetty|ata_sff)' processors: - drop_fields: fields: ["beat", "process.cmdline"] enabled: true period: 30s processes: ['.*']