good day
I have a problem when I start filebeat I get the following error:
and this is my configuration in filebeat.yml
# ================================= Processors =================================
processors:
# - add_host_metadata:
# when.not.contains.tags: forwarded
# - add_cloud_metadata: ~
# - add_docker_metadata: ~
# - add_kubernetes_metadata: ~
- drop_fields:
when:
network:
observer.ip: '10.252.132.138'
fields: ["agent.name", "agent.hostname", "agent.type", "destination.locality"]
ignore_missing: true
I have a processor to drop certain netflow fields that it sends me, since it is too much information that it sends me to elastic and I only need it to send me specific fields to the condition that I apply to an IP observer, that is to say that it sends me data of only that IP.
for that reason I kindly ask for your help to solve this case because it is important, and this can be useful to more people who have the same problem, when I want to drop fields and send data from a specific ip and also send only the fields I need.
thank you I hope your prompt response with this.