From 7d0251952c15cf67ab99a47ee66e6a0ecbfbfcad Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Wed, 17 May 2023 11:06:16 -0400
Subject: [PATCH] Filter out uneeded Logstash metadata

---
 .../pipelines/config/so/0013_input_http_fleet.conf        | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/salt/logstash/pipelines/config/so/0013_input_http_fleet.conf b/salt/logstash/pipelines/config/so/0013_input_http_fleet.conf
index 894ecddb2..f3257eb20 100644
--- a/salt/logstash/pipelines/config/so/0013_input_http_fleet.conf
+++ b/salt/logstash/pipelines/config/so/0013_input_http_fleet.conf
@@ -10,4 +10,12 @@ input {
     ssl_verify_mode => "peer"
     ecs_compatibility => v8
   }
+}
+
+filter {
+   if "elastic-agent" in [tags] {
+  mutate {
+    remove_field => ["http","[metadata][input]","url","user_agent"]
+}
+   }
 }
\ No newline at end of file