[SOLVED]How to remove agent.* and ecs.version?

Ok in case this can help some people here it worked it was just some indent issues in the filebeat.yml file.

It works with the following processor definition:

processors:
  - drop_fields:
      fields: ["agent.ephemeral_id", "agent.hostname", "agent.id", "agent.type", "agent.version", "ecs.version", "input.type", "log.offset", "version"]
7 Likes