Hi,
I am trying to modify the filebeat-7.5.0-apache-access-default my goal is to remove part of the url.original field using gsub but then when simulating I dont see any change.
So far my procedure was
Deleting the current filebeat-7.5.0-apache-access-default in ES.
Posting a modified version, the only change is I added a gsub processor in the list:
The idea is to remove everything from and after "&r" e.g. /products?s=soap&r=sometoken
I simulate it after and the url.original field is unchanged, any ideas? Thank you!!
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.