Remove some fields about logstash

Elastic Stack Logstash
1

Hi everyone,
I add three fields: day,month,year to adjust my index time.
But I want to remove these three fields.
How can I do .

input {
stdin { }
}
filter {
	
    grok {
            match => { "message" => '%{SYSLOGTIMESTAMP} %{IPV4:iphost} date=%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{GREEDYDATA:fgtlogmsg}'
            }
			match => { "message" => '<%{NONNEGINT:syslog_pri}>date=%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{GREEDYDATA:fgtlogmsg}'
            }
			
    }
	
    kv {
            source => "fgtlogmsg"
			remove_field => ["fgtlogmsg"]
    }

	syslog_pri { }
	if "_grokparsefailure" in [tags] {
	drop { }
}
}
output {
    elasticsearch {
            codec => "json" 
            hosts => ["127.0.0.1:9200"]
			index => "logstash-%{year}-%{month}-%{day}"
            
    }
    stdout { codec => rubydebug }
}

thank you in advance : )

2

Could you use metadata, instead of fields? See https://www.elastic.co/blog/logstash-metadata.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.