# Collecting logs from filebeats at k8s to logstash, can't filter fields

**URL:** <https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038>\
**Category:** Logstash\
**Created:** [August 16, 2024, 3:59pm UTC](https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038 "2024-08-16T15:59:15Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 16, 2024, 4:14pm UTC](https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038/4 "2024-08-16T16:14:14Z")

</div>

You appear to be showing us a document fetched from elasticsearch, so the first thing to understand is that the .keyword fields are added by elasticsearch and do not exist in logstash. Your index mapping (possibly a default one you did not configure) is creating them. You can read more about .keyword fields [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html).

agent.emphemeral\_id and agent.id are fields within the agent object. In elasticsearch or kibana you would refer to them as agent.id, but in logstash you have to refer to them as [agent][emphemeral\_id] and [agent][id]. The logstash syntax allows unambiguous references to fields with names that contain dots, so it can distinguish [a.b][c] and [a][b][c], which both have the same name in elasticsearch.

If you do not send [agent][id] to elasticsearch then [agent][id][keyword] will not be created.

You could remove these with

```
mutate { remove_fields => ["[agent][emphemeral_id]", "[agent][id]" ] }

```

---

_[View the full topic](https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038)._