Remove fields
This transformation allows you to remove from the events.
This is useful to remove unneeded data from the log streams, reducing the size of logs, processing power and storage required to store and archive the logs. Which is very useful to reduce the cost of thrid party SIEMs as Splunk, Exabeam / LogRhythm, ArcSight or QRadar. You can remove as many fields as needed.
Last updated