Using
remove_field => ["json","message","[alert][explanation]] i can successfully remove til the field explanation but it cuts to much, so I need to cut it as os-changes as last filed.
But I get stuck into problem that buttom example doesn't cut os-changes
"alert": [ { "src":
{ "url": "xxxx",
"domain": "xxxx",
"smtp-mail-from": "xxxxxxxx"
},
"severity": "xxxx",
"dst": { "smtp-to": "xxxxx"
},
"explanation": {
"protocol": "",
"service": "xxxxxx",
"analysis": "binary",
"os-changes": [ {XXXXXXX }] # and want to remove all included in os-changes array, because i contains a lots of data that is only overhead to our system, it should be simple
}
}
]
I suppose syntax would be
remove_field => ["json","message","[alert][explanation][os-changes]"]
but for some reason it doesn't work, I'm still getting filed os-changes and its subfields.
Dubravko
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.