Processors not working

Elastic Stack Beats
1 
#=========================== Filebeat prospectors =============================
filebeat.config.prospectors:
  enabled: true
  path: conf.d/*.yml

#============================= Filebeat modules ===============================

filebeat.config.modules:
  enabled: false
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================
processors:
- include_fields:
    fields: ["json.stars", "json.PT", "json.clientVer", "json.resVersion", "json.offline", "json.levelid", "json._serverDate"]
2

Why you think they are not working?

Do you have full configs? I see you have external prospector config loading enabled, but without those configs I'm missing context.

3

Thank you, I fixed it.

- type: log
  enabled: true
  paths:
    - /var/www/statistic/ck4/local_logs/ad_info.log
  fields:
    app: ck4
    log_type: ad_info
  json.keys_under_root: false
  processors:
    - include_fields:
        fields: ["fields.log_type", "fields.app", "json.cur_page", "json.PID", "json._serverDate", "json.placement", "json.location", "json.PT"]
    - drop_event:
        when:
          not:
            or:
              - equals:
                  json.cur_page: 1
              - equals:
                  json.cur_page: 2
              - equals:
                  json.cur_page: 4

This is the correct config.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.