PacketBeat

Elastic Stack Beats
1

Hi Team,

I am trying to use processors to limit data but drop fields and events not working together.

processors:

  • drop events:
    regexp:
    system.process.name: "svchost*"

  • drop_fields:
    fields: ["_id", "_index", "_score"]
    ignore_missing: True

'''

Please if anyone can help.

2

Hi Team,

Need some help here

Regards
Nirav

3

What do you mean by "not working"?