Wildcard with drop_fields

Elastic Stack Beats
1

Hi,

I wish to drop multiple fields starting with the same pattern (e.g. postgresql.database.rows.*) from my metricbeat config.

I've tried the following syntax but it does not seem to work:

  processors:
  - drop_fields:
      fields: ["postgresql.database.rows.*"]

Am I using a wrong syntax or is wildcard with the field names simply not supported at all?

Thank you in advance for your reply.

2

Wildcards are currently not supported. For your case the following could work:

fields: ["postgresql.database.rows"]

It will remove the rows object which contains all the other fields. Haven't tested this but I think that should work.

3

Thanks ruflin, using the syntax you provided did the trick!