logstash - Remove unnecessary fields in ElasticSearch -
we populating elasticsearch via logstash. thing see unnecessary fields had remove example:
@version file geoip host message offset tags
is possible defining/extending dynamic template? if yes, how? if no, can via logstash configuration?
your appreciated.
you can remove fields using logstash filter - when filter succeeds, remove field.
it makes sense me use mutate:
filter { mutate { remove_field => [ "file" ] } }
that said, of these fields incredibly useful , should not removed.
Comments
Post a Comment