CODEWITHSUNDEEP
elasticsearchlogstash
user1052610
user1052610

Reputation: 4719

Configuring Logstash to only include certain fields

Using filter, mutate, and remove_field, Logstash con be configured to exclude certain fields from the output.

But what if one only knows the names of the fields to be included, and wants to exclude all other fields (the names of which one did not know up front). How could this be done?

Thanks

Upvotes: 3

Views: 2737

Answers (1)

Magnus Bäck
Magnus Bäck

Reputation: 11571

You can use a ruby filter:

filter {
  ruby {
    code => "
      wanted_fields = ['message', 'foo']
      event.to_hash.keys.each { |k|
        event.remove(k) unless wanted_fields.include? k
      }
    "
  }
}

Related:

Upvotes: 8

Related Questions