Drop fields/Remove Fields in bulk is not working using mutate filter

Hi All

I have almost 50 fields which starts with

parsed.abc or [parsed][abc]
parsed.xyz OR [parsed][xyz]
parsed.dfg OR [parsed][dfg ] etc....

I need to drop all those using mutate. I am able to drop them one by one but not in bulk. Have anyone tried bulk dropping,

This one field i can drop

 mutate {
    remove_field => [ "tags" ]

How to drop field with multiple sub-fields as described above. I tried this one

 mutate {
    remove_field => ["[parsed]*"]

This is not working for me

Wildcards aren't supported. Doesn't

remove_field => ["[parsed]"]

work? Or do you want to keep some of the subfields?

This works perfectly. Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.