Send only some fields of processor 'add_host_metadata'

[felixbarbeira (Félix Barbeira)]

I'm using filebeat and I only need a couple of fields from the processor "add_host_metadata". The only way I found to send those events is the following:

processors:
  - add_host_metadata: ~

And then on Elasticsearch ingest pipeline remove all the fields:

"remove": {
  "field": [
    "host.architecture",
    "host.containerized",
    "host.id",
    "host.os.name",
    "host.os.family",
    "host.os.version",
    "host.os.kernel"
  ]
}

It would be perfect if exist some way to send from filebeat only the fields I want, somebody knows if is this possible?

[dedemorton]

Try using the drop_fields processor:

processors:
- add_host_metadata: ~
- drop_fields:
    fields: ["host.architecture", "host.containerized", "host.id", "host.os.name", "host.os.family", "host.os.version", "host.os.kernel"]