And I want to drop all the logs that have "Microsoft Intune" as [Actor][ID].
I tried different ways through filter but nothing worked: if [Actor.ID] == "Microsoft Intune" { drop{} }
or if [Actor][ID] == "Microsoft Intune" { drop{} }
or if "Microsoft Intune" in [Actor.ID] { drop{} }
thanks for reply. If I would add a field, for example: drop:yes
how could the code change?
Anyway I tried to change my pipeline but I obtain the following error: [ERROR][logstash.filters.ruby ] Ruby exception occurred: no implicit conversion of String into Integer
That should be if x["ID"] == "Microsoft Intune". actor is an array, so it has to be indexed using an integer. x is a hash, so it is indexed using a key.
I do not understand your question about adding a field.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.