# Defining fields for metricsets **URL:** \ **Category:** Beats\ **Tags:** beats-module, metricbeat\ **Created:** [January 11, 2021, 12:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720 "2021-01-11T12:31:48Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![efftee](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@efftee](https://discuss.elastic.co/u/efftee)\ **Post date:** [January 11, 2021, 12:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/1 "2021-01-11T12:31:48Z")
Hi there, Using a single metricbeat agent to finetune settings before a larger deployment to 3000+ hosts, and trying to contain the number of fields to only those required, I seem to hit a wall at the "metricsets" level. I would like to configure more finely the exact fields I require (or remove those I don't). For example : In the metricbeat/modules.d/system.yml I can activate/deactivate the - load metricset. However, how could I choose to only send load1 (or exclude load5 and load15) ? Best regards, ---
**Author:** ![efftee](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@efftee](https://discuss.elastic.co/u/efftee)\ **Post date:** [January 12, 2021, 9:15am UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/2 "2021-01-12T09:15:48Z")
Alternatively, maybe, and if all else fails, which is the best way to look for filtering out fields at the ingest stage from the receiving side of the elasticsearch instance... There is no logstash on elaticcloud. Would I be looking at ingest pipelines ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 12, 2021, 9:50am UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/3 "2021-01-12T09:50:45Z")
I've moved this to the Beats category to see if anyone can help there. > [@efftee](#): > > There is no logstash on elaticcloud. Would I be looking at ingest pipelines ? Definitely. ---
**Author:** ![efftee](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@efftee](https://discuss.elastic.co/u/efftee)\ **Post date:** [January 12, 2021, 11:43am UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/4 "2021-01-12T11:43:56Z")
Right. So I received confirmation from support that we cannot select a subset of fields for any given metricset of a beat agent module. That closes that part definitely (only alternative for not shipping unwanted fields would be to create your own agent). I wonder if this is also true when using the fleet management feature (I suppose yes...). Anyhow, looking into ingest node pipelines processors seems indeed to be the cheapest route to filtering out unwanted fields before index insertion. Now, still reading up on processor possibilities, I only seem so far to have found rules to exclude certain fields (with use of the [remove processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/remove-processor.html) ). Again, if I could just select the wanted fields, instead of excluding all unwanted could be a time saver (and potentially more ressource efficient).... To be continued... ---
**Author:** ![efftee](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@efftee](https://discuss.elastic.co/u/efftee)\ **Post date:** [January 12, 2021, 9:09pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/5 "2021-01-12T21:09:15Z")
So just as a conclusion to this question for any forum dwellers who might tumble here : - You may filter out fields directly from the agent's [main configuration](https://www.elastic.co/guide/en/beats/metricbeat/current/defining-processors.html#where-valid), or from specific modules configurations, by using the [drop-field processor](https://www.elastic.co/guide/en/beats/metricbeat/current/drop-fields.html) ; - You may alternatively filter them out through a dedicated ingest node pipeline by using a [remove processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/remove-processor.html). ---
**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Post date:** [January 12, 2021, 9:13pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/6 "2021-01-12T21:13:48Z")
You might want to look at the [drop\_fields](https://www.elastic.co/guide/en/beats/metricbeat/current/drop-fields.html) processor of Metricbeat. It does effectively the same thing as the remove processor, but on the agent side, thus reducing what you need to send. ---
**Author:** ![efftee](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@efftee](https://discuss.elastic.co/u/efftee)\ **Post date:** [January 12, 2021, 9:19pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/7 "2021-01-12T21:19:16Z")
Wow. Really ? Before they are shipped ? 🙂 Thank you ! Do you configure this in each module's setting `module.yml`, or in the main `metricbeat.yml` ? [edit] [self-answer] The documentation states both places are possible... Thanks ! ---
**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Post date:** [January 12, 2021, 9:21pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/8 "2021-01-12T21:21:50Z")
You can do either/or. This part of the docs explains it: [https://www.elastic.co/guide/en/beats/metricbeat/current/defining-processors.html#where-valid](https://www.elastic.co/guide/en/beats/metricbeat/current/defining-processors.html#where-valid) ---
**Author:** ![efftee](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@efftee](https://discuss.elastic.co/u/efftee)\ **Post date:** [January 12, 2021, 9:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/9 "2021-01-12T21:31:29Z")
Thank you ever so much. You've been spot on ! I've selected my recap above as a solution for the thread because it groups all the findings on the topic, but you've actually nailed it for my question. _Aligatô !_ Funny how the elasticsearch support team told me (and in brief words) how this was impossible... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2021, 9:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720/10 "2021-02-09T21:31:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.