I need to disable Filebeat shipping for some default fields, such as beat.hostname, host, source etc.
How do I do that? Is that even possible?
Using the following does not seem to work:
#======================= Processors =================== # disable shipping certain fields processors: - drop_event: when: regexp: message: "beat.hostname"
Many thanks in advance!