Prune filter - Whitelist JSON subfields & per-pipeline log file

Elastic Stack Logstash
1

Hi All,

I've got a couple of questions!

  1. Can I whitelist only certain field from JSON using Prune? I saw similar topics suggesting ruby but wanted to avoid this as its a bit too complicated for me.
    For instance I'd like to whitelist LogData.Tracepoint (check below picture)
    I'm going to need this as I'm planning to get this field into Sentinel using the log analytics output plugin.

Below picture is my output

image
image1066×807 147 KB

  1. in logstash.yml when I set the pipeline.separate_logs: to true, do I need to create a log file or such is being automatically generated getting the name from the config file for that particular pipeline?
2

prune only works on top-level fields.

log4j2 will create the log files, you do not need to do it.

3

Thank you very much @Badger

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.