file beat采集日志中的agent.id值被filebeat保留字段覆盖

processors:

  - decode_json_fields:

      fields: ['message']

      process_array: true

      max_depth: 200

      target: ''

      overwrite_keys: true

  - drop_fields:

      fields: ['message', 'ecs', 'beat', 'input_type', 'tags', 'count', '@version', 'log', 'offset', 'type', 'host']

  - rename:

      fields:

        - from: "data.aws.sourceIPAddress"

          to: "@src_ip"

      ignore_missing: true

      fail_on_error: false

      when:

        regexp:

          data.aws.sourceIPAddress: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b

  - rename:

      fields:

        - from: "data.srcip"

          to: "@src_ip"

      ignore_missing: true

      fail_on_error: false

      when:

        regexp:

          data.srcip: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b

  - rename:

      fields:

        - from: "data.win.eventdata.ipAddress"

          to: "@src_ip"

      ignore_missing: true

      fail_on_error: false

      when:

        regexp:

          data.win.eventdata.ipAddress: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b