https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406804#M72170 <P>As I understand it, the original fields are always retained. </P> Thu, 28 Jun 2018 12:33:44 GMT richgalloway 2018-06-28T12:33:44Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406803#M72169 <P>I am forwarding windows events from graylog to a UF and then UF to Indexer.<BR /> I have a props.conf to create field alias from the Graylog fields. Once I have these I want to eliminate the gray log fields from being indexed.</P> <P>Here is Props.conf.</P> <PRE><CODE>FIELDALIAS-winlogbeat_as_host = winlogbeat_fields_collector_node_id as host FIELDALIAS-winlogbeat_as_eventid = winlogbeat_event_id as EventCode FIELDALIAS-winlogbeat_as_processname = winlogbeat_event_data_ProcessName as Process_Name FIELDALIAS-winlogbeat_as_logonid = winlogbeat_event_data_TargetLogonId as Logon_ID FIELDALIAS-winlogbeat_as_user = winlogbeat_event_data_TargetUserName as user FIELDALIAS-winlogbeat_as_src_user = user as src_user FIELDALIAS-winlogbeat_as_action = winlogbeat_keywords as action FIELDALIAS-winlogbeat_as_security_id = winlogbeat_event_data_TargetUserSid as Security_ID FIELDALIAS-winlogbeat_as_account_domain = winlogbeat_event_data_TargetDomainName as Account_Domain FIELDALIAS-winlogbeat_as_logontype = winlogbeat_event_data_LogonType as Logon_Type FIELDALIAS-winlogbeat_as_srcip = winlogbeat_event_data_IpAddress as src_ip FIELDALIAS-winlogbeat_as_src = winlogbeat_computer_name as src FIELDALIAS-winlogbeat_as_destip = src_ip as dest_ip </CODE></PRE> <P>How would I eliminate the winlogbeat fields from being indexed?</P> <P>Thanks!</P> Thu, 28 Jun 2018 11:51:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406803#M72169 pfabrizi 2018-06-28T11:51:11Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406804#M72170 <P>As I understand it, the original fields are always retained. </P> Thu, 28 Jun 2018 12:33:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406804#M72170 richgalloway 2018-06-28T12:33:44Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406805#M72171 <P>That is what I thought. </P> <P>Thank You!</P> Thu, 28 Jun 2018 13:13:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-filter-out-fields-via-Props-conf/m-p/406805#M72171 pfabrizi 2018-06-28T13:13:13Z