0

I'm using the elapsed-plugin filter in Logstash, How can I add some of the end-tag log fields to the elapsed new event (if, I set new_event_on_match to true). I wants to drop the actual logs and keep only the elapse event logs.

krishnacm
  • 93
  • 8

1 Answers1

0

I had resolved this by adding drop () for the other log events

if "elapsed" in [tags] {
    ... 

}else {
      drop {}
}
krishnacm
  • 93
  • 8