Hi, I want to prune my logs and only take some fields. Here is my logstash config file but this config didnt work. How can solve this issue? input { beats { port => 5044 } } filter { json { source => "message" remove_field => "message" } prune { white…

If you really just want the one field then prune { whitelist_names => [ "^layers" ] } mutate { add_field => { "ip_src_host" => "%{[layers][ip][ip_ip_src_host]}" } } mutate { remove_field => [ "layers" ] }

Discuss the Elastic Stack

[SOLVED]Prune Filter Question

Elastic Stack Logstash

kolten (Kadir YAPAR) July 31, 2019, 1:36pm 8

Thanks @Badger it worked.

Topic		Replies	Views
Prune filter does not work Logstash	7	1357	April 7, 2022
Prune filter does not work with whitelist but it does with blacklist Logstash	2	295	December 7, 2023
Looking for a way to prune fields with certain text in them but struggling with the prune filter and regex Logstash	2	1062	November 28, 2018
Filtering json fields to be outputted by logstash Logstash	3	3026	August 9, 2017
Prune filter plugin - How whitelist a nested field? Logstash	4	2594	December 15, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

[SOLVED]Prune Filter Question

Related topics