How do I remove fields from a message? I have an extractor for the message field. Through pipelines does not exit.
I do it with pipeline, here is my pipeline sample. please make sure to attach them with all_stream or any specific stream which you use for logs
rule "Remove additional fields" when is_not_null("foo") then remove_field("facility"); remove_field("msg"); end
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.