WARNING: Version 6.2 of Winlogbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Drop events Keep fields from events »
Elastic Docs ›Winlogbeat Reference [6.2] ›Configuring Winlogbeat ›Filter and Enhance the exported data

Drop fields from events

edit

Drop fields from events

edit

The drop_fields processor specifies which fields to drop if a certain condition is fulfilled. The condition is optional. If it’s missing, the specified fields are always dropped. The @timestamp and type fields cannot be dropped, even if they show up in the drop_fields list.

processors:
 - drop_fields:
     when:
        condition
     fields: ["field1", "field2", ...]

See Conditions for a list of supported conditions.

If you define an empty list of fields under drop_fields, then no fields are dropped.

« Drop events Keep fields from events »