How to remove all the Host&Cloud fields added to Filebeats/Elasticsearch index?


I finally got Filebeats/Elasticsearch/Kibana working.

However the stack seems to have injected a lot of cloud tags (e.g. and host tags (host.os.kernel) that has inflated the data and makes it hard to read. How can I remove them please?

Thank you,

You could set drop_fields processor to drop field you dont need.

Thanks, I actually ended up doing something more radical and commented them all out.

         #- add_host_metadata:
         #when.not.contains.tags: forwarded
      #- add_cloud_metadata: ~
      #- add_docker_metadata: ~
      #- add_kubernetes_metadata: ~

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.