From the snippet can we change the servername to SERVER.
Kibana is just picking up fields it sees in your index, and in your screenshot it already sees a field called SERVER, so that field is also there in your index already. Use your pipeline filter to make sure servername field content gets put into the SERVER field instead and you can also use such a pipeline to remove the servername field from all future indexes. Though, you should have the source system stop populating such a field. If you're using curator to remove indexes after x days then you can refresh the field list after x days and servername should just drop off.
Thanks for your response.
Could be please elaborate on the below info.
''Use your pipeline filter to make sure servername field content gets put into the SERVER field instead and you can also use such a pipeline to remove the servername field from all future indexes.""
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.