Can filebeat be configured to don't ship it's own fields such as beat.name, beat.version, source, offset?
I have found older topic asking this thing here: Simplifying Filebeat JSON Output Format suggesting use of filter, but I can't find any documentation about it and it seems to not work in Filebeat 5.0
I am using filebeat to ship JSON formatted log lines into Elastic Search. This is my configuration:
filebeat.prospectors: - input_type: log paths: -C:\...\logs\* json.message_key: Timestamp json.keys_under_root: true #This was the suggested way #filter: # - include_fields.fields: ["message"]