# Drop\_Fields doesn't work - Filebeat

**URL:** <https://discuss.elastic.co/t/drop-fields-doesnt-work-filebeat/277183>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 28, 2021, 7:58am UTC](https://discuss.elastic.co/t/drop-fields-doesnt-work-filebeat/277183 "2021-06-28T07:58:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\
**Post date:** [June 28, 2021, 7:58am UTC](https://discuss.elastic.co/t/drop-fields-doesnt-work-filebeat/277183/1 "2021-06-28T07:58:01Z")

</div>

Hi All,

I have configured filebeat to read IIS logs using the IIS module. In the same time, I want to drop unwanted fields to save the space of my ES server.

I have enabled the IIS module using below command.

```auto
.\filebeat.exe modules enable iis

```

when I check the event through Kibana, I can see following fields in the events though I never enabled those modules in my setting.

```auto
suricata..*
traefik*

```

Hence to remove unwanted fields including above and some fields generated by IIS module I configured processers in the filebeat.yml but it is not dropping those fields but throwing errors.

following is the processors section of the filebeat.yml file.

```auto
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
  - drop_fields:
      fields: ["agent", "destination.address", "ecs", "event", "fileset.name", "host.id", "host.hostname", "host.os.platform", "host.os.type", "input.type", "log.offset", "related.ip", "source.address", "suricata", "traefik.access.user_agent.os_name", "user_agent.original", "user_agent.os.name", "user_agent.os.version"]

```

Below is the debug log generated by filebeat.

```auto
2021-06-28T12:08:24.448+0530	DEBUG	[processors]	processing/processors.go:128	Fail to apply processor global{add_host_metadata=[netinfo.enabled=[true], cache.ttl=[5m0s]], condition=!contains: map[], add_cloud_metadata={}, add_docker_metadata=[match_fields=[] match_pids=[process.pid, process.ppid]], add_kubernetes_metadata, drop_fields={"Fields":["agent","destination.address","ecs","event","fileset.name","host.id","host.hostname","host.os.platform","host.os.type","input.type","log.offset","related.ip","source.address","suricata","traefik.access.user_agent.os_name","user_agent.original","user_agent.os.name","user_agent.os.version"],"IgnoreMissing":false}}: 
failed to drop field [destination.address]: key not found; failed to drop field [related.ip]: key not found; failed to drop field [source.address]: key not found; failed to drop field [suricata]: key not found; failed to drop field [traefik.access.user_agent.os_name]: key not found; failed to drop field [user_agent.original]: key not found; failed to drop field [user_agent.os.name]: key not found; failed to drop field [user_agent.os.version]: key not found

```

Here I have two concerns,

1. Why suricata.\* traefik.\* fields are there though I haven't enabled them?
2. Why drop\_field processor is not applying correctly. Is there a specific order when processing the event.  
ex: global processors first IIS module then.

Thanks  
Someunguy1026

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2021, 9:58am UTC](https://discuss.elastic.co/t/drop-fields-doesnt-work-filebeat/277183/2 "2021-07-26T09:58:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.