Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Export Connector Install: Configure Logstash Filter Plugin (Optional)

Document created by RSA Information Design and Development Employee on Oct 15, 2020Last modified by RSA Information Design and Development Employee on Jan 13, 2021
Version 2Show Document
  • View in full screen mode

You can configure the Logstash Filter plugin to add, remove, or modify the specific input events from the Log Decoder or Decoder. To configure the Filter plugin, add the Filter plugin parameter settings in the second section of the Logstash configuration file (netwitness-<decoder-ip>-input.conf). This plugin modifies the events based on the parameter settings. You can use the existing standard Logstash filter plugins for adding the parameter settings to the configuration file. For more information on existing Logstash standard filter plugins, see Filter Plugin Documentation.

The configuration of the plugin must consist of the plugin name followed by a block of parameter settings for that plugin. The following is an example of Logstash mutate filter plugin configuration parameters that remove specific meta keys.

mutate {
remove_field => ["ip_dst", "ip_addr"]

You are here
Table of Contents > (Optional) Configure Logstash Filter Plugin