Could you please help me with an issue about metricbeat? I have tried to set up a new drop_events (processors) but unsucessfully. I want to drop every events that doesn't have "system". Can you please let me know if it is possible to do that?
See what I set up in metricbeat.yml file
I really appreciate your help and time
drop_event.when:
not:
has_fields: ['system']
Follow the example below:
{
"@timestamp": "2021-07-13T08:03:27.547Z",
"@metadata": {
"beat": "metricbeat",
"type": "_doc",
"version": "7.10.0"
},
"event": {
"dataset": "system.diskio",
"module": "system"
},
"metricset": {
"period": 60000,
"name": "diskio"
},
"fields": {
"uuid": "*********************************"
},
"ecs": {
"version": "1.6.0"
},
"agent": {
"hostname": "************",
"ephemeral_id": "****************************",
"id": "*************************************",
"name": "***********",
"type": "metricbeat",
"version": "7.10.0"
},
"service": {
"type": "system"
},
"host": {
"disk": {
"read.bytes": 237568,
"write.bytes": 2743296
},
"name": "**********"
},
"tag": "metricbeat",
"customer_id": "3"
}