Is it possible to avoid unwanted log fields in Filebeat?

Elastic Stack Beats
1

Hi,

I am using Filebeat GA 5.0.0. I have log files having entries like;

<Jan 16, 2017 9:35:11 AM GMT> <field_a> <field_b> <field_c> <field_d> <field_e> <field_f> <field_g> <field_h> <field_i> <field_j> <field_k>

I dont want to populate fields <field_c>, <field_d>, <field_e> and <field_f> in my elasticsearch. Currently, I am achieving this at Logstash, using grok and mutate. Is it possible to do this in FIlebeat, so that Filebeat removes these unwanted entries before shipping?

Thanks in advance.

2

No, this is not possible.

It would only be possible if the logs were structured as JSON then you could parse them in Filebeat and drop_fields. But you need grok.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.