Do not drop whole event just remove auditLogTrailerMessages field.

mkubenka · mkubenka · commit cb91dbd67848 · 2017-06-18T12:48:05.000+02:00
diff --git a/2081_filter_section_h_convert_to_key-value.conf b/2081_filter_section_h_convert_to_key-value.conf
@@ -34,7 +34,7 @@ filter {
           "
       }
 
-      drop {
+      mutate {
         remove_field => ['auditLogTrailerMessages']
       }
     }

Original file line number	Diff line number	Diff line change
`@@ -34,7 +34,7 @@ filter {`
`34`	`34`	`"`
`35`	`35`	`}`
`36`	`36`
`37`		`- drop {`
	`37`	`+ mutate {`
`38`	`38`	`remove_field => ['auditLogTrailerMessages']`
`39`	`39`	`}`
`40`	`40`	`}`