# AH!--Websites being setup as fields--KV plugin

**URL:** <https://discuss.elastic.co/t/ah-websites-being-setup-as-fields-kv-plugin/111799>\
**Category:** Logstash\
**Created:** [December 14, 2017, 3:19pm UTC](https://discuss.elastic.co/t/ah-websites-being-setup-as-fields-kv-plugin/111799 "2017-12-14T15:19:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Sanchez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_sanchez/32/120056_2.png) [@Daniel\_Sanchez](https://discuss.elastic.co/u/Daniel_Sanchez)\
**Post date:** [December 14, 2017, 3:19pm UTC](https://discuss.elastic.co/t/ah-websites-being-setup-as-fields-kv-plugin/111799/1 "2017-12-14T15:19:15Z")

</div>

Oh wow, my number of fields blew up last night after I added a new server pushing logs to our logstash server. For some reason it's taking all of websites and setting those as fields. I think it's related to the KV plugin, and I put the following, but the websites are still being added.

Any idea what I'm doing wrong to block those websites from being created as fields? Here's what it looks like:

kv {  
exclude\_keys =\> ["http\*"]  
remove\_field =\> ["http\*"]  
source =\> "foo"  
}

I added the http lines this morning after the fields count skyrocketed overnight. Any help would be appreciated, thank you!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 14, 2017, 3:25pm UTC](https://discuss.elastic.co/t/ah-websites-being-setup-as-fields-kv-plugin/111799/2 "2017-12-14T15:25:11Z")

</div>

What does the rest of the configuration look like? What does an input line look like? And an event produced by Logstash?

---

<div class="post-metadata">

**Author:** ![Daniel\_Sanchez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_sanchez/32/120056_2.png) [@Daniel\_Sanchez](https://discuss.elastic.co/u/Daniel_Sanchez)\
**Post date:** [December 14, 2017, 3:45pm UTC](https://discuss.elastic.co/t/ah-websites-being-setup-as-fields-kv-plugin/111799/3 "2017-12-14T15:45:03Z")

</div>

OK, don't laugh, my firewall logstash configuration is quite a bit more complex, but for this linux server one, I'm a firm believer in less is more a lot of times, so:

filter {

```
metrics {
    meter => "documents"
    add_tag => "metric"
    flush_interval => 60
}

grok {
      tag_on_failure => ["_failed1"]
      match => ["message", "%{GREEDYDATA:foo}"]

```

}  
kv {  
exclude\_keys =\> ["http\*"]  
remove\_field =\> ["http\*"]  
source =\> "foo"  
}

That's it!

As far as an event produced by logstash, here's where something weirder happens. I get an error of " Courier Fetch: 2 of 24 shards failed. ", which is odd because other searches work fine just not when using those website fields.

So, in Kibana I'm typing something like this(without the quotes: "[http://website.com](http://website.com):\*" just to see if I can get you an event, and got that error. Also, I did look up in Kibana that [http://website.com.keyword](http://website.com.keyword) is a searchable field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2018, 3:45pm UTC](https://discuss.elastic.co/t/ah-websites-being-setup-as-fields-kv-plugin/111799/4 "2018-01-11T15:45:13Z")

</div>

Closed on January 11, 2018, 3:45pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.