Cribl 利用function 對parser 進行特殊過濾處理:

Parser Function – Fields Filter Expression?

When you use the Stream Parser Function's Reserialize option, there is a special option that becomes available, called the Fields Filter Expression. This is basically a filter expression that's used in determining whether a field gets included when the event is reserialized: