filebeat - 使用 filebeat 处理器时出现“缺少或无效条件”错误

Question

我正在使用 filebeat 处理器删除包含单词“hello”的日志。

filebeat.inputs:
  - type: log
    enabled: true
    fields_under_root: true
    tail_files: true
    paths:
      - /path/to/log

processors:
  # drop logs by filter
  - drop_event:
      when:
        - contains:
            message: "hello"

output:
  logstash:
    hosts:
      - localhost:5044

但这会产生以下错误：

2021-08-25T13:55:12.837+0900    INFO    instance/beat.go:390    filebeat stopped.
2021-08-25T13:55:12.837+0900    ERROR   instance/beat.go:958    Exiting: error initializing processors: failed to initialize condition: missing or invalid condition
Exiting: error initializing processors: failed to initialize condition: missing or invalid condition

文件节拍版本是 7.8。

标签： filebeat