I'm encounter some issue on testing nested field after a grok.
grok { match => { "message" => [ ".*(?<event.action>test) xxxx %{DATA:[name]}" ] } if ( "" in [event][action] ) { mutate { remove_field => "message" } }
But it never remove my message field, wheter [event][action] exist or not.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.