I am using filebeat with a docker processor. Filebeat generate some fields like agent, ecs etc. I am trying to remove these fields using drop_fields processor.
The fields agent.ephemeral_id, agent.version and ecs.version are added later in the processing pipeline. In order to remove those you need to add a drop_fields processor to the global level.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.