Fairly new to Elastic so apologies if this is an obvious issue!
I'm trying to create a new processor to drop any entries containing:
- user_agent.original =="GoogleHC/1.0"
But when I add a processor containing that key/value as a condition, I'm getting an 'unable to create pipeline' message. This would be a useful processor to create as currently we get a lot of GCP health check messages added to our logs and being able to exclude them would be tidier.
Any ideas would be appreciated!