Remove or nullify full_message field after extractors are completed?

I am ingesting logs from Windows Domain Controllers (example full_message), which are quite lengthy. I am using extractors to pull out the fields that I need, how can I remove or nullify the full_message field safely without effecting the extractors?

I am starting to think that these long messages could be the cause of the performance issues in my previous post

You can drop the field in the pipeline as long as you make sure your pipeline processor comes after the message filter chain under system/configurations.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.