How to avoid storing original xml when using the XML filter


(AP) #1

I have defined this XML filter:
xml {
source => "xml_descriptors"
target => "json_descriptors"
force_array => false
}

With the above my ES index contains both the original xml_descriptors (as XML) and the transformed json_descriptors (as JSON).

If I set store_xml => false then nothing gets stored in the index.

How can I just store json_descriptors and completely omit xml_descriptors from the index?


#2

you can use below code, hope this works,

mutate {
remove_field => ["xml_descriptors"]
}


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.