Prune filter does not work with whitelist but it does with blacklist

Elastic Stack Logstash
1

Hello colleagues!

I am trying to use the prune filter with first level fields ( I know the problem with nested fields ) but I can't get it to work.

I have a json of 900 fields and I am interested in keeping only a few, I understand that the best option is the prune via whitelist however this does not work.

When I change whitelist to blacklist, logstash removes the fields I want to keep and ingest the rest.

When I set whitelist it doesn't create the index I want to send to, it's as if it drops everything.

What can cause blacklist to remove my fields of interest but whitelist does not keep them ?

filter example:

if [type] == "cloned" {
    prune {
      whitelist_names => [ "^msg$" , "uuid" ]
    }
}

I would be very grateful for your help!
Thank you so much in advanced!

2

Have you solved this?
Can you show few field names? Is there any fields with similar names? E.g. time, time2, event_time?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.