logstash - How do I exclude the "fingerprint" field from elasticsearch -
i'm using fingerprint filter in logstash create fingerprint field set document_id in elasticsearch output.
configuration follows:
filter { fingerprint { method => "sha1" key => "key" } } output { elasticsearch { host => localhost document_id => "%{fingerprint}" } } this results in redundant fingerprint field in elasticsearch that's same value _id. how prevent redundant field being saved es?
if you're using logstash 1.5 or higher, can put field in metadata , not sent elasticsearch part of regular message.
example:
filter { fingerprint { ... target => "[@metadata][fingerprint]" } } output { elasticsearch { ... document_id => "%{[@metadata][fingerprint]}" } }
Comments
Post a Comment