# Dropping specific container labels from fields

**URL:** <https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [February 25, 2022, 6:26pm UTC](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309 "2022-02-25T18:26:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dario\_Louzado](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Dario\_Louzado](https://discuss.elastic.co/u/Dario_Louzado)\
**Post date:** [February 25, 2022, 6:26pm UTC](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309/1 "2022-02-25T18:26:20Z")

</div>

Hello.  
I'm trying to clean-up my logging events as much as possible in order to save bandwidth and disk space in Elasticsearch.

I want to delete specific labels and preserve others.

Below is my full YAML file:

```auto
name: docker
processors:
  - add_docker_metadata:
      labels.dedot: True
  - drop_fields:
      fields: ["docker", "input", "log", "host", "@metadata"]        
      ignore_missing: true
filebeat:
  config:
    modules:
      path: ${path.home}/modules.d/*.yml
      reload.enabled: false

  autodiscover.providers:
    - type: docker
      labels.dedot: True
      templates:
        - condition:
            equals.docker.container.labels.logformat: generic
          config:
            - type: container
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              fields_under_root: true
              fields:
                type: "genericcattlev1"
                cattle_env: ${CATTLE_ENVIRONMENT}
              processors:
                - drop_fields:
                    fields: >
                      ["container.labels.org_opencontainers_image_authors", 
                      "container.labels.org_opencontainers_image_created", 
                      "container.labels.org_opencontainers_image_description", 
                      "container.labels.org_opencontainers_image_documentation", 
                      "container.labels.org_opencontainers_image_revision", 
                      "container.labels.org_opencontainers_image_source", 
                      "container.labels.org_opencontainers_image_title", 
                      "container.labels.org_opencontainers_image_version", 
                      "container.labels.prom_path", 
                      "container.labels.prom_port", 
                      "container.labels.prom_target"]

output.logstash:
  hosts: ["${LOGSTASH_HOST}:8850"]
  ssl.certificate_authorities: ["/pki/ca/ca.crt"]
  ssl.certificate: "/pki/certs/filebeat/tls.crt"
  ssl.key: "/pki/certs/filebeat/tls.key"

```

I tried many things. Previously, I tried to put the second (bigger) "drop\_fields" together with the first one. Neither worked.

Is it the right way to reference a specific label?

```auto
container.labels.org_opencontainers_image_authors

```

Am I missing something?  
Thanks and regards.

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [February 28, 2022, 8:56am UTC](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309/2 "2022-02-28T08:56:20Z")

</div>

Hi @Dario_Louzado !

Could you try with something like `docker.container.labels.org_opencontainers_image_authors` ?

Docs: [Autodiscover | Filebeat Reference [8.0] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html#_docker_2)

---

<div class="post-metadata">

**Author:** ![Dario\_Louzado](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Dario\_Louzado](https://discuss.elastic.co/u/Dario_Louzado)\
**Post date:** [March 8, 2022, 12:47pm UTC](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309/3 "2022-03-08T12:47:13Z")

</div>

It worked @ChrsMark . Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2022, 2:47pm UTC](https://discuss.elastic.co/t/dropping-specific-container-labels-from-fields/298309/4 "2022-04-05T14:47:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.