Filebeat drop_fields processors module does not work


We have elastic gold licence. we use filebeat agent to send logs logstash, on logstash we do some transformation and send logs to elasticsearh.

Before I was dropping default values on logstash but now I want to drop fields on the source. I added the config below to filebeat but the fields are keeps coming.

-input_type: log
   - drop_fields:
       fields: ["ecs", "input", "agent"]
       ignore_missing: true

Is there any chance if the fields that I am trying to drop created on logstash? instade of filebeat?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.