I want to ingest JSON PE file data that has 40+ fields w/nested fields. I only want the first few fields. Is there a way to either drop the unwanted fields or can I explicitly state which fields I want?
To filter top-level fields you can use a prune filter with whitelist_names.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.