What does this filter do?


(P) #1

Hello,

can anybody explain me what does the following filter do ?

filter {
  if [@metadata][input-http] {
    date {
      match => [ "date", "UNIX" ]
      remove_field => [ "date" ]
    }
    mutate {
      remove_field => ["headers","host"]
    }
  }
}

(Andreas H) #2

if the @metadata tag contains "input-http" then:
Use the "date" field (which is in UNIX Epoch format) and turn it into the @timestamp field (by default)
Then remove the "date" field (since the info is now in @timestamp)
Next use the mutate filter and remove the two fields "headers" and "host"
End.