# Configure filebeat to send only required fields

**URL:** <https://discuss.elastic.co/t/configure-filebeat-to-send-only-required-fields/181479>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 16, 2019, 9:24pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-send-only-required-fields/181479 "2019-05-16T21:24:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [May 16, 2019, 9:24pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-send-only-required-fields/181479/1 "2019-05-16T21:24:24Z")

</div>

Hi

My filebeat send the following data to ES. I don't need all the fields Is there a way I can configure filebeat to send only required fields.

Supporse I only need few fileds from the below data to be sent to ES.

```
{
  "_index": "filebeat-2019.05.15-000001",
  "_type": "_doc",
  "_id": "Ezl_wmoB3maiDp4bI8vP",
  "_version": 1,
  "_score": null,
  "_source": {
    "agent": {
      "hostname": "hostname.com",
      "id": "e0b20292-8514-4a64-8890-418e1e80c7dc",
      "type": "filebeat",
      "ephemeral_id": "ee293ff1-e8fa-423a-8f3e-0f40e7a902fb",
      "version": "7.0.1"
    },
    "log": {
      "file": {
        "path": "/usr/share/tomcat/logs/localhost_access_log.2019-05-16.txt"
      },
      "offset": 11473
    },
    "source": {
      "address": "10.49.102.104",
      "ip": "10.49.102.104"
    },
    "fileset": {
      "name": "access"
    },
    "url": {
      "original": "/portal/home/"
    },
    "input": {
      "type": "log"
    },
    "apache": {
      "access": {}
    },
    "@timestamp": "2019-05-16T21:14:25.000Z",
    "ecs": {
      "version": "1.0.0"
    },
    "service": {
      "type": "apache"
    },
    "host": {
      "hostname": "hostname.com",
      "os": {
        "kernel": "3.10.0-862.14.4.el7.x86_64",
        "codename": "Maipo",
        "name": "Red Hat Enterprise Linux Server",
        "family": "redhat",
        "version": "7.5 (Maipo)",
        "platform": "rhel"
      },
      "containerized": true,
      "name": "hostname.com",
      "id": "0709cd0acc86463da7d518c28f145a66",
      "architecture": "x86_64"
    },
    "http": {
      "request": {
        "method": "HEAD"
      },
      "response": {
        "status_code": 200
      },
      "version": "1.1"
    },
    "fields": {
      "version": "10.6"
    },
    "event": {
      "created": "2019-05-16T21:14:32.293Z",
      "module": "apache",
      "dataset": "apache.access"
    },
    "user": {
      "name": "-"
    }
  },
  "fields": {
    "suricata.eve.timestamp": [
      "2019-05-16T21:14:25.000Z"
    ],
    "@timestamp": [
      "2019-05-16T21:14:25.000Z"
    ],
    "event.created": [
      "2019-05-16T21:14:32.293Z"
    ]
  },
  "sort": [
    1558041265000
  ]
}
```

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 16, 2019, 9:35pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-send-only-required-fields/181479/2 "2019-05-16T21:35:11Z")

</div>

For this you can use the [Include fields processor:](https://www.elastic.co/guide/en/beats/filebeat/current/include-fields.html)

```auto
processors:
 - include_fields:
     fields: ["log.file", "source.address", ...]

```

This will result in documents with only the included fields them.

See the docs for further details like conditions and also have a look at the complementary [Drop fields processor.](https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html)

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [May 16, 2019, 9:43pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-send-only-required-fields/181479/3 "2019-05-16T21:43:07Z")

</div>

Thanks for the quick reply. I am using IIs module for windows and apache module for linux server logs.

So when using the modules we have iis.yml and apache.yml which have fields defined in it. Can I still used processors to remove unwanted fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2019, 9:43pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-send-only-required-fields/181479/4 "2019-06-13T21:43:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.