filter.yml

filter {
        if [type] == "telemetry" {
                geoip { source => "ip" }
        } else if [fields][type] == "telemetry" {
                # How do I target a nested field here, vs. what is above?
                geoip { source => "[message][ip]" }
                prune { blacklist_names => [ "[message][headers]" ] }
        }
}