Filebeat - disabling shipping default fields

Elastic Stack Beats
1

Hi all,

I need to disable Filebeat shipping for some default fields, such as beat.hostname, host, source etc.
How do I do that? Is that even possible?

Using the following does not seem to work:

#======================= Processors ===================
# disable shipping certain fields
processors:
 - drop_event:
     when:
        regexp:
           message: "beat.hostname"

Many thanks in advance!

2

Ok, got it. The correct config:

processors:
 - drop_fields:
     fields: ["beat.hostname", "beat.name"]
3

This topic was automatically closed after 21 days. New replies are no longer allowed.