Filebeat fields error.message disable/remove from Table

Elastic Stack Beats
1

Hi,
I have modified filebeat index and index template by removeing error.message field but it is still visible in discovery table. Is there any thing else I should do remove this message. I dont use Logstash and dont know how to configure grok processor in filebeat to parse the log without Provided Grok expressions do not match field value message. Can you advise?

Thanks!

2

You visit existing processors in filebeat (pipeline.yml files). To build your own grok expression, feel free to use Grok debugger (e.g. https://grokdebug.herokuapp.com/)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.