the problem is that you have an array of signatures
you have few options here.
first and ugly one is to provide enough remove entries so it will look like this
- drop_event
fields: ["signatures.[0].marks","signatures.[1].marks","signatures.[2].marks", etc.]
or use log stash (if you have one) and use ruby filter as discussed here: Logstash filter mutate remove_field inside of an array