# Can't remove fields in logstash 5.2.2

**URL:** <https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571>\
**Category:** Logstash\
**Created:** [March 14, 2017, 5:46pm UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571 "2017-03-14T17:46:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![orlevy08](https://avatars.discourse-cdn.com/v4/letter/o/b77776/32.png) [@orlevy08](https://discuss.elastic.co/u/orlevy08)\
**Post date:** [March 14, 2017, 5:46pm UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571/1 "2017-03-14T17:46:29Z")

</div>

Hi all,  
I'm trying to remove the "remove" field and the default fields (host, @version, etc...) but can't seems to achieve this goal.

Here is my conf file:  
input {  
file {  
path =\> ["E:/TestLog.txt"]  
start\_position =\> "beginning"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{WORD:vendor}: %{TIMESTAMP\_ISO8601:localEventTime} - %{WORD:remove} - [%{IP:userIP}] %{USERNAME:username}(%{WORD:group})[] - %{GREEDYDATA:vpnMsg}" }  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}  
}

and from some reason, when trying to add:  
mutate {remove\_field =\> ['remove']}

I get an error grokparsefailure

Can somebody help me?  
Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 14, 2017, 6:53pm UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571/2 "2017-03-14T18:53:35Z")

</div>

> and from some reason, when trying to add:  
> mutate {remove\_field =\> ['remove']}

> I get an error grokparsefailure

Sorry, I don't buy that story. Instead of doing that just don't capture the field in the first place, i.e. replace `%{WORD:remove}` with `%{WORD}`.

I'm not sure `@version` can be deleted.

---

<div class="post-metadata">

**Author:** ![orlevy08](https://avatars.discourse-cdn.com/v4/letter/o/b77776/32.png) [@orlevy08](https://discuss.elastic.co/u/orlevy08)\
**Post date:** [March 14, 2017, 7:53pm UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571/3 "2017-03-14T19:53:19Z")

</div>

I've changed the WORD:remove to WORD as you suggested.  
When running the conf now I receive the following error:  
"path" =\> "E:/TestLog.txt",  
"@timestamp" =\> 2017-03-14T19:51:04.449Z,  
"@version" =\> "1",  
"host" =\> "Orr-PC",  
"message" =\> "\r",  
"tags" =\> [  
[0] "\_grokparsefailure"

why? is something wrong with my conf file?  
This is the updated conf file:

> input {  
> file {  
> path =\> ["E:/TestLog.txt"]  
> start\_position =\> "beginning"  
> }  
> }  
> filter {  
> grok {  
> match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{WORD:vendor}: %{TIMESTAMP\_ISO8601:localEventTime} - %{WORD} - [%{IP:userIP}] %{USERNAME:username}(%{WORD:group}) - %{GREEDYDATA:vpnMsg}" }  
> }  
> }  
> output {  
> stdout {  
> codec =\> rubydebug  
> }  
> }

and this is the log file i'm trying to parse:

2017-02-14T13:39:33+02:00 PulseSecure: 2017-02-14 13:39:33 - ive - [10.16.4.225] dpnini(Users) - Testing Password realm restrictions failed for dpnini/Users

---

<div class="post-metadata">

**Author:** ![orlevy08](https://avatars.discourse-cdn.com/v4/letter/o/b77776/32.png) [@orlevy08](https://discuss.elastic.co/u/orlevy08)\
**Post date:** [March 14, 2017, 7:58pm UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571/4 "2017-03-14T19:58:38Z")

</div>

btw - the parsing is working on grok debugger and gives the expected output:  
%{TIMESTAMP\_ISO8601:timestamp} %{WORD:vendor}: %{TIMESTAMP\_ISO8601:localEventTime} - %{WORD} - [%{IP:userIP}] %{USERNAME:username}(%{WORD:group})[] - %{GREEDYDATA:vpnMsg}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 15, 2017, 6:27am UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571/5 "2017-03-15T06:27:01Z")

</div>

> why? is something wrong with my conf file?

It looks like the input contains an empty line that you're trying to parse. You can use a conditional to drop empty lines.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2017, 6:27am UTC](https://discuss.elastic.co/t/cant-remove-fields-in-logstash-5-2-2/78571/6 "2017-04-12T06:27:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.