How to remove beat field and host field

(Luzhzhsoft) #1

My output contains beat ,host ,@timestamp @metadat filed as default.I want remove beat ,host fields from input.I define processor ,but it not work for beat and host filelds.I do not want to use pipeline ,because I have my own field named host,and this filed will be overwite by filebeat.

(Luzhzhsoft) #2

Es document say only @timestamp and type will not be remove by processor.But it is seems not work for beat ,host fields

(Luzhzhsoft) #3

Well.I use top levle processors ,works fine.My configruation may have some problem.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.