How to omit filebeat fields such as source file path?

Elastic Stack Beats
1

Hi,
Can filebeat be configured to don't ship it's own fields such as beat.name, beat.version, source, offset?

I have found older topic asking this thing here: Simplifying Filebeat JSON Output Format suggesting use of filter, but I can't find any documentation about it and it seems to not work in Filebeat 5.0

I am using filebeat to ship JSON formatted log lines into Elastic Search. This is my configuration:

filebeat.prospectors:
- input_type: log
  paths: 
    -C:\...\logs\*
  json.message_key: Timestamp
  json.keys_under_root: true

  #This was the suggested way          
  #filter:
  #  - include_fields.fields: ["message"]
2

It works. The processor documentation is here for Filebeat 5.x. Here's an example.

filebeat.prospectors:
- paths: [input.test]

output.console.pretty: true

processors:
  - drop_fields.fields: [beat, source, offset]
3

Thank you!

Compared with the earlier topic Processor: is the keyword instead of Filter:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.