How to filter beat data by version on logstash?

Elastic Stack Logstash
1

How to filter beat data by version on logstash ?

I tried code as belw on logstash config , but it did not work. I want to filter out version 6.8.6 data

input {
  beats {
    port => 5044
  }
}

filter {
if [agent.version] == "6.8.6"  { drop { } }
if ["%{[@metadata][version]}"] == "6.8.6" { drop { } }
}

output {
  elasticsearch {
    hosts => ["192.168.0.37:9092"]
    manage_template => false
    validate_after_inactivity => 60000
    index => "filebeat-%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }

   stdout { 
    codec => rubydebug
  }
}
2

This should be the correct code for that:
if [@metadata][version] == "6.8.6" { drop { } }

1 Like
3

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.