Filter out beat.*

Elastic Stack Logstash
1

I have no use for the beat.hostname, beat.name or beat.version fields and would like to filter them out. This filter does not work:

cat /etc/logstash/conf.d/input.conf

filter {
mutate { remove_field => [ "beat.name", "beat.version", "beat.hostname" ] }
}

Am I missing something?

2 
mutate { remove_field => [ "[beat][name]", "[beat][version]", "[beat][hostname]" ] }
3

Thank you @Badger. That fixed my filter. Appreciate your time and expertise.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.