Winlogbeats remove @metadata, agent and ecs fields

Elastic Stack Beats
1

Hello,

Is it possible to not include in exported log fields:

@metadata, agent and ecs?

I added processor

- drop_fields:
            fields: ["host", "log", "event", "agent", "ecs", "winlog", "@metadata"]

and most of fields were removed but not agent, ecs and @metadata

2

Hi Witkacy,

There's a similar post on stackoverflow for Filebeat regarding @metadata,
Perhaps you could take a look at the solution there to see if it helps with your situation.

You need to remove the additional add_host_metadata and add_cloud_metadata metadata you're adding explicitly and remove the remainder of the fields with the drop_field processor:

Hope this helps you!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.