# Correct way to remove unnecessary fields from filebeat

**URL:** https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443
**Category:** Beats
**Tags:** filebeat
**Created:** [July 1, 2020, 8:53am UTC](https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443 "2020-07-01T08:53:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sfenman](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@sfenman](https://discuss.elastic.co/u/sfenman)
#### Post date: [July 1, 2020, 8:53am UTC](https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443/1 "2020-07-01T08:53:26Z")

</div>

Hello,

I send different types of logs from filebeat directly to ES and I have noticed in kibana discover tab that my some logs have empty fields which they are used by other log entries. For example, my production log entries have fields like :

```auto
    aws.cloudtrail.user_identity.session_context.creation_date  
    cef.extensions.fileCreateTime

```

which as I can understand are,module fields, but I never activated those modules.  
Can you suggest me the correct way to drop them, or to disable from being generated?

---

<div class="post-metadata">

### Author: ![sfenman](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@sfenman](https://discuss.elastic.co/u/sfenman)
#### Post date: [July 23, 2020, 7:19am UTC](https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443/2 "2020-07-23T07:19:14Z")

</div>

Update on this: Filebeat puts those module fields in all of my log files even from different filebeat agents installed in different instances. All those fields are empty though.

 ![Screenshot from 2020-07-23 10-12-33](https://us1.discourse-cdn.com/elastic/original/3X/f/a/fa86dee8b2af569714c80fe9e01f338d772d6e9e.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2020, 9:19am UTC](https://discuss.elastic.co/t/correct-way-to-remove-unnecessary-fields-from-filebeat/239443/3 "2020-08-20T09:19:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.