How to remove all the Host&Cloud fields added to Filebeats/Elasticsearch index?

Elastic Stack Beats
1

Hello,

I finally got Filebeats/Elasticsearch/Kibana working.

However the stack seems to have injected a lot of cloud tags (e.g. cloud.account.id) and host tags (host.os.kernel) that has inflated the data and makes it hard to read. How can I remove them please?

Thank you,
Houman

2

You could set drop_fields processor to drop field you dont need.

3

Thanks, I actually ended up doing something more radical and commented them all out.

    #processors:
         #- add_host_metadata:
         #when.not.contains.tags: forwarded
      #- add_cloud_metadata: ~
      #- add_docker_metadata: ~
      #- add_kubernetes_metadata: ~
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.