Hello colleagues!
I am trying to use the prune filter with first level fields ( I know the problem with nested fields ) but I can't get it to work.
I have a json of 900 fields and I am interested in keeping only a few, I understand that the best option is the prune via whitelist however this does not work.
When I change whitelist to blacklist, logstash removes the fields I want to keep and ingest the rest.
When I set whitelist it doesn't create the index I want to send to, it's as if it drops everything.
What can cause blacklist to remove my fields of interest but whitelist does not keep them ?
filter example:
if [type] == "cloned" {
prune {
whitelist_names => [ "^msg$" , "uuid" ]
}
}
I would be very grateful for your help!
Thank you so much in advanced!