Filtering exported fields (Phase 1)

[monicasarbu]

The goal is to configure each Beat not to export all fields. There should be two options how to reduce the number of exported fields:

• Configuration options, by adding configuration options for most common use cases.
• Generic filtering for more specific use cases, based on conditionals. A proposal is described in Proposal Generic Filtering (Phase 2) #451 and it is part of the Phase 2.

Configuration options

The configuration options are specific to each Beat. The biggest advantage is the performance. We can apply the actions at the beginning, before even creating the event.

There are already few configuration options, already implemented, in Packetbeat, Topbeat and Filebeat that restrict the number of fields to be exported like the send_request or send_response from Packetbeat or stats from Topbeat to specify the type of statistics to collect.

But new ones are requested like:

Topbeat

• Make optional exporting cpu usage per core: Make optional cpu usage per core  #424

Filebeat

• Remove or include only some fields: https://github.com/elastic/filebeat/issues/78
• Exclude specific files: https://github.com/elastic/filebeat/issues/298

[monicasarbu]

Closing as all the features are implemented and it will be available in the next release.