Filebeat, ship logs raw

Elastic Stack Beats
1

Hello, I am wondering if there is an option to have filebeat only send the data it collects, not all the fields it adds itself like agent, ecs, etc

My problem is that due to filebeat setting host.name, it overwrites my logs field called host and then breaks my logstash configuration.

I am experimenting with solutions to this but in this use case what would be best for me is just to not create all that extra data

2

Have you tried using the drop_fields processor of Filebeat? https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.