Remove event.original from logstash as it comes in every document of logstash version 8.8.2(ECS)

[PRASHANT_MEHTA]

Hello All,

I am facing major issue with logstash after migration from 7.9.1 to 8.8.2 version.
Elasticsearch/Logstash 8.X version has ECS compatibility enabled by default.This adds new field
event.original in every document indexed in elasticsearch from logstash.
To ignore above field i.e event.original we've added pipeline.ecs_compatibility: disabled in logstash.yml and it eliminates required field.

But it also eliminates other necessary fields like host.name(This value is required by us)
Plz suggest us some solution how to handle this .

Thanks

[Badger]

You could use

mutate { remove_field => [ "event" ] }

or

mutate { remove_field => [ "[event][original]" ] }

[PRASHANT_MEHTA]

Hello @Badger ,

Thanx for your quick response,I will test with this and check if this resolves.