# Filebeat - disabling shipping default fields

**URL:** <https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921>\
**Category:** Beats\
**Created:** [May 8, 2017, 11:15am UTC](https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921 "2017-05-08T11:15:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rs\_ela](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rs\_ela](https://discuss.elastic.co/u/rs_ela)\
**Post date:** [May 8, 2017, 11:15am UTC](https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921/1 "2017-05-08T11:15:45Z")

</div>

Hi all,

I need to disable Filebeat shipping for some default fields, such as beat.hostname, host, source etc.  
How do I do that? Is that even possible?

Using the following does not seem to work:

```
#======================= Processors ===================
# disable shipping certain fields
processors:
 - drop_event:
     when:
        regexp:
           message: "beat.hostname"

```

Many thanks in advance!

---

<div class="post-metadata">

**Author:** ![rs\_ela](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rs\_ela](https://discuss.elastic.co/u/rs_ela)\
**Post date:** [May 8, 2017, 11:35am UTC](https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921/2 "2017-05-08T11:35:24Z")

</div>

Ok, got it. The correct config:

```
processors:
 - drop_fields:
     fields: ["beat.hostname", "beat.name"]
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2017, 11:19am UTC](https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921/3 "2017-05-29T11:19:30Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.