Filebeat not reading JSON Array

Elastic Stack Beats
1

I have "sourceIPs":["127.0.0.1"] in my JSON Logs, I am using drop_events processor conditions like "equals" and "contains" to filter out events having 127.0.0.1 as sourceIP but none of the obvious filters seems to work. Filebeat version - 5.5.

drop_events:
when:
contains:
sourceIPs.0: "127.0.0.1" or tried this filter as well - sourceIPs[0]: "127.0.0.1"
but no luck.

Any help would be highly appreciated.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.