We're outputting mongodb records into filebeat, and then sending those filebeat logs to Elasticsearch, where it will be converted to Json.
However, Mongo has an _id field already, so we get a failed action error from Logstash.
I'm trying to delete the _id field from Mongo.
I thought that I could try to remove the _id field in the filter plugin before it got to output, but I still get the failed action error.
I figured that one workaround
would be that instead of specifying the codec => json on the input plugin,
that I instead use the json filter, and do target => doc, which nests the fields.
I would've preferred them on the top level, but this works fine as well.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.