We're outputting mongodb records into filebeat, and then sending those filebeat logs to Elasticsearch, where it will be converted to Json.
However, Mongo has an _id field already, so we get a failed action error from Logstash.
I'm trying to delete the _id field from Mongo.
I thought that I could try to remove the _id field in the filter plugin before it got to output, but I still get the failed action error.
Any tips on how to mitigate this problem?