如果标头是特定值，则logstash filter drop

Question

我正在使用logstash http输入插件。如果user_agent是特定值，我想过滤和删除。

{
  "_index": "some-logs-prod-2017.09.21",
  "_type": "logs",
  "_id": "AV6kDXSxKY2mOqXynuEV",
  "_score": null,
  "_source": {
    "message": "",
    "@version": "1",
    "@timestamp": "2017-09-21T10:48:12.541Z",
    "host": "172.31.43.24",
    "headers": {
      "request_method": "GET",
      "request_path": "/",
      "request_uri": "/",
      "http_version": "HTTP/1.1",
      "http_host": "172.31.33.62:33067",
      "http_connection": "close",
      "http_user_agent": "ELB-HealthChecker/2.0",
      "http_accept_encoding": "gzip, compressed"
    }
  },
  "fields": {
    "@timestamp": [
      1505990892541
    ]
  },
  "highlight": {
    "headers.http_user_agent": [
      "@kibana-highlighted-field@ELB@/kibana-highlighted-field@-@kibana-highlighted-field@HealthChecker@/kibana-highlighted-field@/2.0"
    ]
  },
  "sort": [
    1505990892541
  ]
}

在这种情况下，我想在http_user_agent == ELB-HealthChecker时如何删除该消息？

Answer 1

由于baudsp，我不得不使用[headers][http_user_agent]。