Filebeat, ship logs raw

Hello, I am wondering if there is an option to have filebeat only send the data it collects, not all the fields it adds itself like agent, ecs, etc

My problem is that due to filebeat setting, it overwrites my logs field called host and then breaks my logstash configuration.

I am experimenting with solutions to this but in this use case what would be best for me is just to not create all that extra data

Have you tried using the drop_fields processor of Filebeat?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.