# Discard documents when indexing with rules

**URL:** https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696
**Category:** Elasticsearch
**Created:** [December 6, 2018, 9:27am UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696 "2018-12-06T09:27:51Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![xavierfacq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavierfacq/32/8744_2.png) [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 6, 2018, 9:27am UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696/1 "2018-12-06T09:27:51Z")

</div>

Hi,

Is it possible to add something like a "rule" into the index mapping/description or whatever configuration that could to resolve the following trick:

We want to inject lot of data into a dedicated indice, but we would like to do not index some of this documents if they do not match a rule. There is a feature that to this trick but only on the field level:

[https://www.elastic.co/guide/en/elasticsearch/reference/6.5/analysis-keep-words-tokenfilter.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/analysis-keep-words-tokenfilter.html)

We would like to do the same but directly reject the indexation of the document is one of the field is  
not in a dictionary.

Any idea ?

Thanks !

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 6, 2018, 10:33am UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696/2 "2018-12-06T10:33:15Z")

</div>

You typically identify this before you send the data to Elasticsearch and simply drop the document. As this is a common ingest requirement Logstash has a drop filter you can use for this. I do not see why you would do this in Elasticsearch.

---

<div class="post-metadata">

### Author: ![xavierfacq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavierfacq/32/8744_2.png) [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 6, 2018, 12:35pm UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696/3 "2018-12-06T12:35:15Z")

</div>

Yes, it's what we use to do for other data, but in this new use-case it would have be interesting to filter documents during the indexation, based on a special dictionary.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 6, 2018, 12:53pm UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696/4 "2018-12-06T12:53:55Z")

</div>

You could use an ingest pipeline with a [drop processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/drop-processor.html).

---

<div class="post-metadata">

### Author: ![xavierfacq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavierfacq/32/8744_2.png) [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)
#### Post date: [December 6, 2018, 12:59pm UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696/5 "2018-12-06T12:59:26Z")

</div>

Ok thank you ! This is very interesting for our usecase ! 👍

Before we would have to switch from 2.4 to 6.x !!!

Thanks !  
Xavier

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2019, 12:59pm UTC](https://discuss.elastic.co/t/discard-documents-when-indexing-with-rules/159696/6 "2019-01-03T12:59:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
