Filebeat 7.16 drop_fields processor not working

Elastic Stack Beats
1

Hello! We are having trouble dropping fields from messages using Filebeat 7.16.
We tried to drop fields using the "drop_fields" processor:

processors:
  - drop_fields:
      fields: ["cisco.ftd.message_id"]
      ignore_missing: true

but to no avail. The field still gets sent to elastic. We also tried using a "script" processor like so:

function process(event) {
    event.Delete("cisco.ftd.message_id")
    return event;
}

- script:
lang: javascript
id: ftd_drop
file: ${path.config}/ftd_drop.js

And the field is still there. It does this with every field.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.