Keep fields from events
Theinclude_fields processor specifies which fields to export if a certain condition is fulfilled. The condition is optional. If it’s missing, the specified fields are always exported. The@timestamp,@metadata andtype fields are always exported, even if they are not defined in theinclude_fields list.
processors: - include_fields: when: condition fields: ["field1", "field2", ...]SeeConditions for a list of supported conditions.
You can specify multipleinclude_fields processors under theprocessors section.
Note
If you define an empty list of fields underinclude_fields, then only the required fields,@timestamp andtype, are exported.