How to drop the fields that Filebeat normally adds (type, source, offset, etc.)

Elastic Stack Beats
1

Hi all
As the title says,but i didn't find the setting about it!

2

Hi @Junble,

I think the setting you are looking for is the drop_fields processor :slight_smile:

3

Prune filter and mutate filter will also work with remove_fields.

4

Hi @Junble ,

You can drop other fields except "type" and "@timestamp", Because these are the mandatory and default field of filebeat. drop_fields processor also can't drop these two fields

1 Like
5

Hi @jsoriano
Thank you, that's what I was looking for!

1 Like
6

Thank you! I'll try it!

7

OK,I see, thank you very much!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.