Filter out beat.*


#1

I have no use for the beat.hostname, beat.name or beat.version fields and would like to filter them out. This filter does not work:

cat /etc/logstash/conf.d/input.conf

filter {
mutate { remove_field => [ "beat.name", "beat.version", "beat.hostname" ] }
}

Am I missing something?


#2
mutate { remove_field => [ "[beat][name]", "[beat][version]", "[beat][hostname]" ] }

#3

Thank you @Badger. That fixed my filter. Appreciate your time and expertise.


(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.