Filebeat drop_fields processors module does not work

Elastic Stack Beats
1

Hi,

We have elastic gold licence. we use filebeat agent to send logs logstash, on logstash we do some transformation and send logs to elasticsearh.

Before I was dropping default values on logstash but now I want to drop fields on the source. I added the config below to filebeat but the fields are keeps coming.

-input_type: log
 processors:
   - drop_fields:
       fields: ["ecs", "input", "agent"]
       ignore_missing: true

Is there any chance if the fields that I am trying to drop created on logstash? instade of filebeat?

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.