Looking through the documentation and I can see how to add static fields, and set those fields into the root level of the json, but I'm having trouble figuring out if there is a way for me to specify which fields I want to keep, and if I can rename each of these fields before the logs are shipped. I also want all of these to stay in root level.
Is this possible? Can I get an example?
You can use processors to remove fields from events. There currently is no processor to rename a field. You need Logstash or Ingest Node to do that.
This topic was automatically closed after 21 days. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.