|
|
- mutate { remove_field => [ "[input][type]", "[prospector][type]", "[beat][name]", "[beat][hostname]", "source", "_score" ] }
|
|
|
+ mutate { remove_field => [ "[input][type]", "[prospector][type]", "[beat][name]", "[beat][hostname]", "source", "_score", "@version", "_id", "[agent][type]", "[agent][id]", "[agent][name]", "[agent][version]", "[agent][ephemeral_id]", "[ecs][version]" ]}
|