0

I currently have logstash input for rest API HTTPs webhooked to my Logstash server.

The application sending is sending heartbeats along with the data packets, and I don't need to store those. So im looking for something like the following in the logstash config:

filter {

  if [heartbeat]: {
       drop{}
  }
     
}

or something along those lines so that the event that contains that field is dropped

Thanks

Meme-ento
  • 3
  • 2
  • To answer this question we need to know the type of the [heartbeat] field. [This](https://stackoverflow.com/questions/30309096/logstash-check-if-field-exists) question has some techniques that cover most types. However, a general solution that can handle fields that exist but are nil cannot exist. What is the field type? – Badger May 12 '23 at 20:28
  • All I see as the value for each is "-" for null, so Im not sure if that would be boolean or not ? I'm seeing the field from target in the XML filter (target.heartbeat) but the value is just "-" – Meme-ento May 12 '23 at 20:54
  • Then it a string, so the question I linked to answers the question. – Badger May 12 '23 at 20:59

0 Answers0