Hello! We are having trouble dropping fields from messages using Filebeat 7.16.
We tried to drop fields using the "drop_fields" processor:
processors: - drop_fields: fields: ["cisco.ftd.message_id"] ignore_missing: true
but to no avail. The field still gets sent to elastic. We also tried using a "script" processor like so:
And the field is still there. It does this with every field.