How Do I Remove Fields Using Logstash Filters?

3 years ago logit.io

Summary: This is a summary of an article originally published by the source. Read the full original article here →

Learn the best practices for removing and mutating fields in your logs and metrics using Logstash filters. You can remove these using the mutate filter plugin.

This setting should point to an array of field names (or a single field name): filter { mutate { remove_field => ["field_name"]} }

If you want to remove more than one field you can supply additional field names to the array: filter { mutate { remove_field => ["%{@index}","%{@version}","%{@type}"] }}

If you enjoyed this post on how to remove fields using Logstash filters then why not check out our guide on https://logit.io/blog/post/how-to-pick-the-right-type-of-log-data-visualisation or our https://logit.io/blog/post/kibana-elk-cheatsheet.

DevOps Articles