intelmq
intelmq copied to clipboard
Field Reducer: Support to remove sub-fields in extra
(non-urgent) feature idea by an IntelMQ user:
If the event contains, for example
{
"extra.source.naics: 1,
"extra.source.sic: 2
}
setting
type: blacklist
keys: extra.source
does not delete the two fields.