Filebeat didn't drop some of the fields like agent.*, ecs.* etc

Elastic Stack Beats
,
2

The fields agent.ephemeral_id, agent.version and ecs.version are added later in the processing pipeline. In order to remove those you need to add a drop_fields processor to the global level.

filebeat.inputs:
- type: docker
  containers.ids: 
    - '*'
  processors:
  - add_docker_metadata: ~
  - drop_fields:
      fields: ["container.image","container.labels"]
      ignore_missing: true

processors:
- drop_fields:
    fields: ["agent.ephemeral_id", "agent.version", "ecs.version"]
    ignore_missing: true

setup.dashboards.enabled: true
2 Likes