logstash - Remove unnecessary fields in ElasticSearch -


we populating elasticsearch via logstash. thing see unnecessary fields had remove example:

@version file geoip host message offset tags 

is possible defining/extending dynamic template? if yes, how? if no, can via logstash configuration?

your appreciated.

you can remove fields using logstash filter - when filter succeeds, remove field.

it makes sense me use mutate:

filter {     mutate {         remove_field => [ "file" ]     } } 

that said, of these fields incredibly useful , should not removed.


Comments

Popular posts from this blog

java - Date formats difference between yyyy-MM-dd'T'HH:mm:ss and yyyy-MM-dd'T'HH:mm:ssXXX -

c# - Get rid of xmlns attribute when adding node to existing xml -