# Drop\_fields

**URL:** <https://discuss.elastic.co/t/drop-fields/330045>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 14, 2023, 9:49pm UTC](https://discuss.elastic.co/t/drop-fields/330045 "2023-04-14T21:49:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![y34rz3r0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/y34rz3r0/32/124582_2.png) [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\
**Post date:** [April 14, 2023, 9:49pm UTC](https://discuss.elastic.co/t/drop-fields/330045/1 "2023-04-14T21:49:31Z")

</div>

Hello!

I've just started learning ELK and I'm having some confusion with filebeat's drop\_fields processor.

My configuration:

```auto
filebeat.inputs:
  - type: log
    paths:
      - /mnt/var/log/ovpnagent.log
    fields_under_root: true
    processors:
      - drop_fields:
          fields: ["ecs", "input", "host"]
    enabled: true

```

Only the "input" field is dropped, while "host" and "ecs" remain. I also tried to use variants with "ecs.version" and "host.name", but nothing changed.

Can someone point me to my mistake and show me where it is explained in the documentation?

---

<div class="post-metadata">

**Author:** ![y34rz3r0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/y34rz3r0/32/124582_2.png) [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\
**Post date:** [April 14, 2023, 10:58pm UTC](https://discuss.elastic.co/t/drop-fields/330045/2 "2023-04-14T22:58:54Z")

</div>

Okay, my mistake was that some fields are added later than processing, so a global processor is needed.

Like this:

```auto
filebeat.inputs:
  - type: log
    paths:
      - /mnt/var/log/ovpnagent.log
    fields_under_root: true
    enabled: true

processors:
  - drop_fields:
      fields: ["ecs", "input", "host"]

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 15, 2023, 12:00am UTC](https://discuss.elastic.co/t/drop-fields/330045/3 "2023-04-15T00:00:40Z")

</div>

@y34rz3r0 Welcome to the community! and thanks for posting your solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2023, 2:01am UTC](https://discuss.elastic.co/t/drop-fields/330045/4 "2023-05-13T02:01:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.