New

The executive guide to generative AI

Read more
About usPartnersSupport|Login

WARNING: Version 6.1 of Winlogbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Drop events Add additional fields to events »
Elastic Docs ›Winlogbeat Reference [6.1] ›Configuring Winlogbeat ›Filter and Enhance the exported data

Drop fields from events

edit

Drop fields from events

edit

The drop_fields processor specifies which fields to drop if a certain condition is fulfilled. The condition is optional. If it’s missing, the specified fields are always dropped. The @timestamp and type fields cannot be dropped, even if they show up in the drop_fields list.

processors:
 - drop_fields:
     when:
        condition
     fields: ["field1", "field2", ...]

See Conditions for a list of supported conditions.

If you define an empty list of fields under drop_fields, then no fields are dropped.

« Drop events Add additional fields to events »
Was this helpful?
Feedback