Filebeat (6.5.4) modules how to remove unused fields

Elastic Stack Beats
1

Hi,

i am using some filebeat modules (nginx, logstash, elasticsearch, kibana, redis), but some of the produced fields are not important for me and I don't want to save them in elasticsearch. Is there a possibility to remove these fields like in logstash with "remove_field"?

Thank you very much!

2

Filebeat modules do not parse the fields in Filebeat, but Elasticsearch via Ingest Nodes. You can find the pipeline definitions in module/*/*/ingest/*.json (replace * with module + fileset names). You can adapt or copy those up to your needs. When done run filebeat setup --pipeline, so to reinstall the Ingest Node pipelines.

3

Hi @steffens, thank you very much for your response!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.