Packetbeat: Disable return_value for Redis protocol

(Paul) #1

Hi, in my usecase Redis is used as a cache-server and stores big bunches of data. All that data is returned at redis.return_value field for each request what can lead to high resources consumption at ElasticSearch server.
I've checked source code for Redis protocol and looks like there's no way to disable that field:

Is there any way to disable that field? Or maybe it's a task for packetbeat's enhancement?

Thanks ahead!

(Steffen Siering) #2

Right now you can not remove return_value from within packetbeat. With generic filtering (still in development, see open PR #1623) you will be able to remove any unwanted fields from your events.

Still makes sense to have an enhancement for limiting the return_value it's size.

(Paul) #3

Thank you, it would be grade to have a way to disable some fields!
I also found some noisy fields for DNS protocol which I would like to suppress too.

(system) #4