Hi all,
I'm new to the Kibana. I'm trying to remove the field based on some condition. But not getting how to do..
I've used the below code.
filter {
grok {
break_on_match => false
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}] %{LOGLEVEL:loglevel} %{GREEDYDATA:log}|%{GREEDYDATA:log1}"}
}
if[log] =~ "(?i) applicable" {
grok{
remove_field => ["log"]
}
}
}
If log contains keyword "applicable", log field has to be removed furtherly.Please anyone help me out in resolving the issue. Any help would greatly appreciated.
Thank you in advance.