Prune filter - Whitelist JSON subfields & per-pipeline log file

[stillfreem]

Hi All,

I've got a couple of questions!

1. Can I whitelist only certain field from JSON using Prune? I saw similar topics suggesting ruby but wanted to avoid this as its a bit too complicated for me.
   For instance I'd like to whitelist LogData.Tracepoint (check below picture)
   I'm going to need this as I'm planning to get this field into Sentinel using the log analytics output plugin.

Below picture is my output

2. in logstash.yml when I set the pipeline.separate_logs: to true, do I need to create a log file or such is being automatically generated getting the name from the config file for that particular pipeline?

[Badger]

prune only works on top-level fields.

log4j2 will create the log files, you do not need to do it.

[stillfreem]

Thank you very much @Badger