How to drop field in message

Elastic Stack Beats
1

Hi all !

processors:

  • drop_fields:
    fields: ["_source.message.index", "_source.message.layers", "_source.message.frame", "_source.message.eth", "fields", "tags"]

I want to delete the fields not required in message as: "_source.message.index", "_source.message.layers", "_source.message.frame", "_source.message.eth", "fields", "tags"

Message content

t message {"timestamp" : "1534413881819", "layers" : {"frame": {"frame_frame_interface_id": "0","frame_interface_id_frame_interface_name": "eno2","frame_frame_encap_type": "1","frame_frame_time": "Aug 16, 2018 17:04:41.819181684 +07","frame_frame_offset_shift": "0.000000000","frame_frame_time_epoch": "1534413881.819181684","frame_frame_time_delta": "0.001338664","frame_frame_time_delta_displayed": "0.001338664","frame_frame_time_relative": "7.695004114","frame_frame_number": "9316","frame_frame_len": "625","frame_frame_cap_len": "625","frame_frame_marked": "0","frame_frame_ignored": "0","frame_frame_protocols":

Thanks all !

2

Could you please format the processor configuration using </>?
Also, what is exactly the problem with this config?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.