- Auditbeat Reference: other versions:
- Overview
- Getting started with Auditbeat
- Breaking changes in 6.2
- Setting up and running Auditbeat
- Configuring Auditbeat
- Specify which modules to run
- Specify general settings
- Reload the configuration dynamically
- Configure the internal queue
- Configure the output
- Set up index lifecycle management
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Enrich events with geoIP information
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- Regular expression support
- HTTP Endpoint
- auditbeat.reference.yml
- Modules
- Exported fields
- Monitoring Auditbeat
- Securing Auditbeat
- Troubleshooting
- Contributing to Beats
NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.
Keep fields from events
editKeep fields from events
editThe include_fields processor specifies which fields to export if a certain
condition is fulfilled. The condition is optional. If it’s missing, the
specified fields are always exported. The @timestamp and type fields are
always exported, even if they are not defined in the include_fields list.
processors: - include_fields: when: condition fields: ["field1", "field2", ...]
See Conditions for a list of supported conditions.
You can specify multiple include_fields processors under the processors
section.
If you define an empty list of fields under include_fields, then only
the required fields, @timestamp and type, are exported.
Was this helpful?
Thank you for your feedback.