How to delete beat.name field?


(John) #1

Hello,

I am using filebeat to store logs in ES. filebeat adds some beat.XXX fields and I want to remove them (in order to save space).

I am using ES ingest pipeline to process my logs.

I tried the following ingest processor:
"remove" : { "field": "beat.name" },

but it does not work (field still present in ES).
The same remove processor removes my custom fields without a problem.

Why beat.XXX fields are immortal?

Thanks.


(Yannick Welsch) #2

Have you checked that the newly indexed documents still contain the beat.name field? Existing indexed documents will still carry that field and you cannot remove an existing field from the mappings.

Maybe also related to:


(John) #3

Oh, yes! The answer by @mvg in that thread solved my problem.
I was missing extra { ... } around each processor!

Well, it is really sad that I have no parse error during pipeline creating, but rather such an unexpected behaviour later :frowning:


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.