Hello ,
I am a beginner on the ELK solution,
I would like to know if by deleting fields and their contents from my logs I can gain storage space.
If so, how to do this task?
This is what I tried to do:
'
if [event][module] == "panw"
{
geoip {
source => "[client][nat][ip]"
target => "source_geoip"
}
geoip {
source => "[destination][nat][ip]"
target => "destination_geoip"
}
drop {
remove_field => [ "[destination_geoip][longitude]", "[destination_geoip][location]","[log_event][labels]" ,
"[destination_geoip][country_code3]", "[latitude]", "[agent][ephemeral_id]","[source_geoip][longitude]",
"[source_geoip][location]","[source_geoip][country_code3]", "[observer][serial_number]", "[network][community_id]",
"[message]", "[sort]" ]
remove_tag => [ "[destination_geoip][longitude]", "[destination_geoip][location]", "[log_event][labels]" ,
"[destination_geoip][country_code3]" "[latitude]", "[agent][ephemeral_id]", "[source_geoip][longitude]",
"[source_geoip][location]","[source_geoip][country_code3]", "[observer][serial_number]", "[network][community_id]",
"[message]", "[sort]" ]
}
}
'
The goal is to reduce storage space on Elasticsearch
Thank you for your attention