1
2
3
4
5

filter {
    xxx {
        add_field => {"project"=>"kibana"}
    }
}

1
2
3
4
5

filter {
    xxx {
        add_tag => ["test"]
    }
}

1
2
3
4
5

filter {
    xxx {
        remove_field => ["test"]
    }
}

1
2
3
4
5

filter {
    xxx {
        remove_tag => ["test"]
    }
}