# Can I only reserve fields parsed from log when output?

**URL:** https://discuss.elastic.co/t/can-i-only-reserve-fields-parsed-from-log-when-output/196461
**Category:** Beats
**Tags:** filebeat
**Created:** [August 23, 2019, 7:39am UTC](https://discuss.elastic.co/t/can-i-only-reserve-fields-parsed-from-log-when-output/196461 "2019-08-23T07:39:31Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Vvv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vvv/32/52878_2.png) [@Vvv](https://discuss.elastic.co/u/Vvv)
#### Post date: [August 23, 2019, 7:39am UTC](https://discuss.elastic.co/t/can-i-only-reserve-fields-parsed-from-log-when-output/196461/1 "2019-08-23T07:39:31Z")

</div>

Hi,  
I want harvest `Nginx` access log using `Filebeat`. Instead of output to `Logstash` / `Elasticsearch`, I just want to send log content to `Kafka` topic. The content may like:

```json
{"foo":"xxx","bar":"yyy"}

```

Then I config `filebeat.yml` `input`:

```auto
- type: log
  enabled: true
  paths:
    - /data/log/nginx/access/overwrite_test/change_root_field_input.log
  json.keys_under_root: true
  json.overwrite_keys: true
  json.add_error_key: true
  fields:
    otype: change_root_field_input
    stattype: json_log

```

However, when I fetch log and feed to console / Kafka, the `output` likes below:

```json
{
  "@timestamp": "2019-08-23T07:24:53.905Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "7.3.0"
  },
  "bar": "yyy",
  "fields": {
    "stattype": "json_log"
  },
  "input": {
    "type": "log"
  },
  "agent": {
    "ephemeral_id": "95a82ced-972a-464b-b985-f3cda3c92681",
    "hostname": "server_1",
    "id": "1f1321f7-098d-4da9-a2df-62e21afb7911",
    "version": "7.3.0",
    "type": "filebeat"
  },
  "ecs": {
    "version": "1.0.1"
  },
  "host": {
    "architecture": "x86_64",
    "os": {
      "platform": "centos",
      "version": "6.10 (Final)",
      "family": "redhat",
      "name": "CentOS",
      "kernel": "2.6.32-696.10.1.el6.x86_64",
      "codename": "Final"
    },
    "containerized": false,
    "name": "server_1",
    "hostname": "server_1"
  },
  "foo": "xxx",
  "log": {
    "offset": 645,
    "file": {
      "path": "/data/log/nginx/access/my_custom.log"
    }
  }
}

```

I just want fields like `foo` and `bar` from nginx log, what's more, my custom field `stattype`. Unfortunately, I got so many fields I don't care and won't use. Because it won't send output to `ElasticSearch` and `Logstash`.

So, can I only ouput my custom fields wihthout `default fields`? I have tried [Drop fields from events](https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html), but it seems only drop `log` fieds and had no idea about other 😔.

Thanks 😊

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2019, 7:39am UTC](https://discuss.elastic.co/t/can-i-only-reserve-fields-parsed-from-log-when-output/196461/2 "2019-09-20T07:39:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.