Drop fields/Remove Fields in bulk is not working using mutate filter


(Ritesh) #1

Hi All

I have almost 50 fields which starts with

parsed.abc or [parsed][abc]
parsed.xyz OR [parsed][xyz]
parsed.dfg OR [parsed][dfg ] etc....

I need to drop all those using mutate. I am able to drop them one by one but not in bulk. Have anyone tried bulk dropping,

This one field i can drop

 mutate {
    remove_field => [ "tags" ]
  }

How to drop field with multiple sub-fields as described above. I tried this one

 mutate {
    remove_field => ["[parsed]*"]
  }

This is not working for me


(Magnus B├Ąck) #2

Wildcards aren't supported. Doesn't

remove_field => ["[parsed]"]

work? Or do you want to keep some of the subfields?


(Ritesh) #3

This works perfectly. Thanks


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.