logstash - How do I exclude the "fingerprint" field from elasticsearch -
i'm using fingerprint
filter in logstash create fingerprint field set document_id
in elasticsearch
output.
configuration follows:
filter { fingerprint { method => "sha1" key => "key" } } output { elasticsearch { host => localhost document_id => "%{fingerprint}" } }
this results in redundant fingerprint
field in elasticsearch that's same value _id
. how prevent redundant field being saved es?
if you're using logstash 1.5 or higher, can put field in metadata , not sent elasticsearch part of regular message.
example:
filter { fingerprint { ... target => "[@metadata][fingerprint]" } } output { elasticsearch { ... document_id => "%{[@metadata][fingerprint]}" } }
Comments
Post a Comment