topic Re: How to stop ingesting a field value in Getting Data In

How to stop ingesting a field value

franciscof — Tue, 17 Nov 2020 19:32:02 GMT

Hi guys, I have an input made from the ASplunk addon for AWS and what I want to do is to stop ingesting a field value. This is cloudflare data and what I want to stop ingesting is the field value WAFAction=unknown

Could I do this through the props and transforms? If so, how should I do it?

Thanks in advance.

Regards,

Re: How to stop ingesting a field value

richgalloway — Tue, 17 Nov 2020 20:19:14 GMT

So you want to not ingest the field WAFAction, but only if the value is "unknown", correct? I'm curious about the use case for that. You may be able to do it with INGEST_EVAL. Here's an untested transform:

[dropunknownwafaction] INGEST_EVAL = WAFAction:=if(WAFAction="unknown", null(), WAFAction)

Re: How to stop ingesting a field value

franciscof — Tue, 17 Nov 2020 20:52:52 GMT

Actually is the other way around. I do not want to ingest that specific field value (WAFAction=unknown). How could I do?

Re: How to stop ingesting a field value

richgalloway — Wed, 18 Nov 2020 14:12:05 GMT

That is why my answer does. It only ingests the WAFAction field if the value is not "unknown".