How to remove field with logstash5.0.2?

Elastic Stack Logstash
1

i remove field be by the below way, but it seems to remove all the event, what‘s the different when using remove_field between drop and grok?
remove all the event

Pasted image728×303 7.41 KB

work
Pasted image900×331 8.94 KB

2

If you read the docs, drop drops everything that gets to this filter -> https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html

You can remove fields in any filter.

mutate {
   remove_field => ["message"]
}
3

ths, i miss it when i read the doc...

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.