Logstash is it possible to drop only field?

[Yaswanth]

Hi,

My usecase i want to drop a field if it doesnt satisfy the value like

if [ServerName] ! "data-0","data-1","data-2" 
  drop ServerName

(i.e. I want to drop the ServerName field in an event if it doesn't have either data-0,data-1,data-2 in it.

Note: I dont want to stop the whole event i just want to drop only the ServerName field.

Thanks

[ld_pvl]

I think mutate should do trick for you https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-remove_field

[Yaswanth]

Thanks
Looking into it but i want to check not equal condition on 3 strings in ServerName field

if !("SERVERNAME" in ["esndata-0", "esndata-1", "esndata-2" ]) {
    mutate { add_tag => "shouldexist" }
  }
}

That is if SERVERNAME doesnt have either of the given strings then it should add a tag.

Is the above syntax is correct?
Thanks

[ld_pvl]

Syntax not exactly correct, uncle google is your friend - this should help https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals