Filebeat : drop fields kubernetes again again

9/8/2021

I m trying to remove some fields, I use filebeat 7.14 on Kubernetes I tried as described in the doc

processors:
  - drop_fields:
      when:
        contains
      fields: ["host.os.name", "host.os.codename", "host.os.family"]
      ignore_missing: false
container failed "ERROR   instance/beat.go:989    
Exiting: Failed to start crawler: 
starting input failed: Error while initializing input: 
missing or invalid condition
failed to initialize condition"

ignore_missing still messing

- drop_fields:
      fields: ["host.os.name", "host.os.codename", "host.os.family"]  

fields are still present

-- Wanexa
elk
filebeat
kibana
kubernetes

1 Answer

9/13/2021

you don't seem to have a condition set under the when. take a look at https://www.elastic.co/guide/en/beats/filebeat/7.14/defining-processors.html#conditions and make sure you've got something for it to match

-- Mark Walkom
Source: StackOverflow