Drop_fields not working on doc

the problem is that you have an array of signatures
you have few options here.

first and ugly one is to provide enough remove entries so it will look like this

-  drop_event
    fields: ["signatures.[0].marks","signatures.[1].marks","signatures.[2].marks", etc.]

or use log stash (if you have one) and use ruby filter as discussed here: Logstash filter mutate remove_field inside of an array