I'm using filebeat 7.1.1
with a simple log file input
filebeat.inputs:
- type: log
When the events are published, there is a "@metadata" object inserted in the event.
{
"@timestamp": "2019-07-10T18:24:56.312Z",
"@metadata": {
"beat": "",
"type": "_doc",
"version": ""
},
...
"agent": {
"type": "filebeat",
"ephemeral_id": "97f29009-c620-4746-9598-66bb651b4707",
"hostname": "pop-os",
"id": "38a65a07-1a0a-4e0a-a651-bc83065f73be",
"version": "7.1.1"
},
...
},
One observation is that the 'beat' and 'version' field are empty. But the data is already in the "agent" object.
How can I remove the "@metadata" object from the events before they are published to the output?
I tried
processors:
- drop_fields:
fields: ["@metadata"]
without much success.
I also could not find the documentation on the "@metadata"
at https://www.elastic.co/guide/en/beats/filebeat/7.1/exported-fields-beat.html