WARNING: Version 5.5 of Winlogbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« drop_event include_fields »
Elastic Docs ›Winlogbeat Reference [5.5] ›Configuring Winlogbeat ›Processors

drop_fields

edit

drop_fields

edit

The drop_fields processor specifies which fields to drop if a certain condition is fulfilled. The condition is optional. If it’s missing, the specified fields are always dropped. The @timestamp and type fields cannot be dropped, even if they show up in the drop_fields list.

processors:
 - drop_fields:
     when:
        condition
     fields: ["field1", "field2", ...]

See Conditions for a list of supported conditions.

If you define an empty list of fields under drop_fields, then no fields are dropped.

« drop_event include_fields »