# Create a new event from some fields

**URL:** https://discuss.elastic.co/t/create-a-new-event-from-some-fields/357082
**Category:** Logstash
**Created:** [April 9, 2024, 2:47pm UTC](https://discuss.elastic.co/t/create-a-new-event-from-some-fields/357082 "2024-04-09T14:47:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)
#### Post date: [April 9, 2024, 2:47pm UTC](https://discuss.elastic.co/t/create-a-new-event-from-some-fields/357082/1 "2024-04-09T14:47:15Z")

</div>

Hi,

I have a log record which looks like

```auto
{
  @timestamp: some_timestamp, 
  metadata_field: metadata_value,
  other_field: other_value,
  message: some_message
}

```

Is it possible to make new event from this log record which will look like

```auto
{
  metadata_field: metadata_value,
  message: some_message
}

```

i.e. I want to keep only `message` and `metadata_field` in a new event.

Use `clone` might be not a good idea because I don't know exactly what `other_field` could be so I can not to delete it/them.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 9, 2024, 3:24pm UTC](https://discuss.elastic.co/t/create-a-new-event-from-some-fields/357082/2 "2024-04-09T15:24:58Z")

</div>

A [prune](https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html) filter might help.

---

<div class="post-metadata">

### Author: ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)
#### Post date: [April 10, 2024, 2:10pm UTC](https://discuss.elastic.co/t/create-a-new-event-from-some-fields/357082/3 "2024-04-10T14:10:10Z")

</div>

@Badger thank you!  
It looks hopefully