# Exclude keys
**URL:** https://discuss.elastic.co/t/exclude-keys/142352
**Category:** Logstash
**Created:** [July 31, 2018, 11:34am UTC](https://discuss.elastic.co/t/exclude-keys/142352 "2018-07-31T11:34:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [July 31, 2018, 11:34am UTC](https://discuss.elastic.co/t/exclude-keys/142352/1 "2018-07-31T11:34:18Z")
**Input file:kvoptions.log**
{"Name":"admin","ConfigurationObjectType":"ExecutionGroup"}
**Configuration file:**
input
{
file
{
path =\> "/home/murugar/Documents/kvoptions.log"
type =\> "file"
start\_position =\> "beginning"
sincedb\_path=\> "/dev/null"
}
}
filter
{
grok
{
match =\> ["message","%{GREEDYDATA:msg}"]
}
```
kv
{
source => "msg"
field_split => ",\{\}"
value_split => ":"
exclude_keys => ["ConfigurationObjectType"]
}
```
}
output
{
```
stdout
{
codec => rubydebug
}
```
}
**Obtained Ouput**
{
"message" =\> "{"Name":"admin","ConfigurationObjectType":"ExecutionGroup"}",
"@version" =\> "1",
"@timestamp" =\> "2018-07-18T01:43:30.128Z",
"path" =\> "/home/murugar/Documents/kvoptions.log",
"host" =\> "0.0.0.0",
"type" =\> "file",
"msg" =\> "{"Name":"admin","ConfigurationObjectType":"ExecutionGroup"}",
""Name"" =\> "admin",
**""ConfigurationObjectType"" =\> "ExecutionGroup"**
}
Expected Ouput:
{
{
"message" =\> "{"Name":"admin","ConfigurationObjectType":"ExecutionGroup"}",
"@version" =\> "1",
"@timestamp" =\> "2018-07-18T01:43:30.128Z",
"path" =\> "/home/murugar/Documents/kvoptions.log",
"host" =\> "0.0.0.0",
"type" =\> "file",
"msg" =\> "{"Name":"admin","ConfigurationObjectType":"ExecutionGroup"}",
""Name"" =\> "admin",
}
}
In other word, the last bolded line should not appear. Why isnt exclude\_keys working?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 31, 2018, 1:59pm UTC](https://discuss.elastic.co/t/exclude-keys/142352/2 "2018-07-31T13:59:07Z")
```
grok { match => ["message","%{GREEDYDATA:msg}"] }
```
What are you trying to achieve here? It just copies one field to another. Why not parse message instead of msg?
Also, your input is valid json. Why not parse it using
```
json { source => "message" }
```
You could then remove fields using
```
mutate { remove_field => ["ConfigurationObjectType"] }
```
To actually answer you question... your field names include double quotes. If you really want to use kv then set
```
exclude_keys => ['"ConfigurationObjectType"']
```
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [August 1, 2018, 2:26pm UTC](https://discuss.elastic.co/t/exclude-keys/142352/3 "2018-08-01T14:26:18Z")
Yes. It worked. I did try with "" but i missed '....'. ( ["ConfigurationObjectType"] didnt work)
In other words , do all the fields need to represented within [' **anyfiledname**'] (are square brackets and ' necessary?)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 1, 2018, 3:06pm UTC](https://discuss.elastic.co/t/exclude-keys/142352/4 "2018-08-01T15:06:39Z")
If you use kv then your field names will contain quotes, so yes, you need to include the quotes in the field names.
As I said, if you use a json filter instead of a kv filter then the field names will not contain quotes and your life will be much easier.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [August 10, 2018, 4:32am UTC](https://discuss.elastic.co/t/exclude-keys/142352/5 "2018-08-10T04:32:35Z")
sure.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2018, 4:32am UTC](https://discuss.elastic.co/t/exclude-keys/142352/6 "2018-09-07T04:32:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.