# Does it possible remove all nested fields except white-list?

**URL:** https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417
**Category:** Logstash
**Created:** [April 5, 2016, 3:12pm UTC](https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417 "2016-04-05T15:12:23Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Alexander\_Popov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexander_popov/32/7154_2.png) [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)
#### Post date: [April 5, 2016, 3:12pm UTC](https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417/1 "2016-04-05T15:12:23Z")

</div>

source:  
{  
"message":"aaa"  
"req":{  
"url":"..."  
......  
},  
"string1":"value",,  
"stringN":"value"  
"int1":1,  
"intN":1,  
"object1":{},  
"objectN":{},  
}

1. Can I remove fields of type "object" except some whitelist? (remove object1...objectN? but leave req)  
2.does it possible to use type of i conditions? like  
if typeof [somefield] == "object" {  
drop{}  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 5, 2016, 5:14pm UTC](https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417/2 "2016-04-05T17:14:19Z")

</div>

The prune filter allows removal of fields by name and by value but not by type so you probably can't use it here, but it's actually a reasonable feature request. I've filed [logstash-filter-prune #6](https://github.com/logstash-plugins/logstash-filter-prune/issues/6) for this. Until that's implemented you'd have to use a ruby filter.

---

<div class="post-metadata">

### Author: ![Alexander\_Popov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexander_popov/32/7154_2.png) [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)
#### Post date: [April 5, 2016, 5:46pm UTC](https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417/3 "2016-04-05T17:46:02Z")

</div>

Does prune now supports nested fields?

with source  
{  
"obj": {  
"0": "...",  
"1": "...",  
"2": "...",  
"11": "...",  
"stack": "asdasdasd"  
}  
}

I'm trying to prune 0...11 subfields :  
prune {  
blacklist\_names =\> ["err.\d+"]  
}

but its not work

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 5, 2016, 5:55pm UTC](https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417/4 "2016-04-05T17:55:11Z")

</div>

It probably doesn't support nested fields, but if it does I would expect it to use the nested field syntax (see [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/does-it-possible-remove-all-nested-fields-except-white-list/46417/5 "2017-07-06T05:03:46Z")

</div>


