How to use the second level of a fields

Elastic Stack Logstash
1

I add a new field "fields.ip "in filebeat's configure file, it look like below：

filebeat:
prospectors:

  • input_type: log
    paths:
    • /home/vagarnt/log/*
      fields:
      ip: 192.168.33.11
      type: formal
      encoding: plain

And the filebeat send data to logstash.
So, the logstash can get the IP information of where the data come from.
I know I can use [fields][ip] to get the ip information, but how to use it in mutate:
for example:
mutate {
remove_field => [ "timestamp", "beat", "input_type", "type", "host", "@version"]
}
I want to remove fields.type, but save the fields.ip, how should I do?

below dosen't work:
remove_field => [ "timestamp", "beat", "input_type", "type", "host", "@version", "fields.type"]

2

I want to remove fields.type, but save the fields.ip, how should I do?

below dosen't work:
remove_field => [ "timestamp", "beat", "input_type", "type", "host", "@version", "fields.type"]

[fields][type], not fields.type.

1 Like
3

Ok, thanks for your reply.