Remove_field for "type" is not working

Elastic Stack Logstash
1

Hi,

I am using multiple files as input, where type => csv is for loading csv file into elatsicsearch and type => syslog is for tracking the exception.

My config looks like below:

input
{
file {
path => "path-to-csv-file/*.csv"
type => "csv"
start_position => beginning
}
file {
path => "path-to-log-file/logstash-plain.log"
type => "syslog"
sincedb_path => "null"
}
}
filter
{
if [type] == "csv"
{
csv
{
columns => [ ............................ ]
separator => ","
}
mutate
{
remove_field => [ "message","path","host","type" ]
}
}
if [type] == "syslog"
{ .......................}
}
output
{
if [type] == "csv"
{
elasticsearch
{ ................ }
}
if [type] == "syslog"
{ .................}
stdout{}
}

Any ideas how can I make it work.

Thank you.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.