# Delete field based on value with variable fieldnames

**URL:** <https://discuss.elastic.co/t/delete-field-based-on-value-with-variable-fieldnames/177570>\
**Category:** Logstash\
**Created:** [April 19, 2019, 6:20am UTC](https://discuss.elastic.co/t/delete-field-based-on-value-with-variable-fieldnames/177570 "2019-04-19T06:20:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [April 19, 2019, 6:20am UTC](https://discuss.elastic.co/t/delete-field-based-on-value-with-variable-fieldnames/177570/1 "2019-04-19T06:20:08Z")

</div>

Hi,

I was wondering if it is possible to remove a field based on the field value without knowing the field name?

In my case I know all unwanted data will contain the value "0000" but the name of the field containing the data will be unknown. There might be multiple fields with the same unwanted data in a single event.

I know you can use conditionals to filter data but that always seem to require a field name.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 19, 2019, 1:57pm UTC](https://discuss.elastic.co/t/delete-field-based-on-value-with-variable-fieldnames/177570/2 "2019-04-19T13:57:31Z")

</div>

```
    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v == "0000"
                    event.remove(k)
                end
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [April 21, 2019, 11:33pm UTC](https://discuss.elastic.co/t/delete-field-based-on-value-with-variable-fieldnames/177570/3 "2019-04-21T23:33:31Z")

</div>

Thanks, I'll try that out 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2019, 11:33pm UTC](https://discuss.elastic.co/t/delete-field-based-on-value-with-variable-fieldnames/177570/4 "2019-05-19T23:33:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.