# Filebeat fields error.message disable/remove from Table

**URL:** <https://discuss.elastic.co/t/filebeat-fields-error-message-disable-remove-from-table/223207>\
**Category:** Beats\
**Created:** [March 11, 2020, 7:37pm UTC](https://discuss.elastic.co/t/filebeat-fields-error-message-disable-remove-from-table/223207 "2020-03-11T19:37:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![northmilo](https://avatars.discourse-cdn.com/v4/letter/n/848f3c/32.png) [@northmilo](https://discuss.elastic.co/u/northmilo)\
**Post date:** [March 11, 2020, 7:37pm UTC](https://discuss.elastic.co/t/filebeat-fields-error-message-disable-remove-from-table/223207/1 "2020-03-11T19:37:39Z")

</div>

Hi,  
I have modified filebeat index and index template by removeing error.message field but it is still visible in discovery table. Is there any thing else I should do remove this message. I dont use Logstash and dont know how to configure grok processor in filebeat to parse the log without Provided Grok expressions do not match field value message. Can you advise?

Thanks!

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 12, 2020, 7:44am UTC](https://discuss.elastic.co/t/filebeat-fields-error-message-disable-remove-from-table/223207/2 "2020-03-12T07:44:25Z")

</div>

You visit existing processors in filebeat (pipeline.yml files). To build your own grok expression, feel free to use Grok debugger (e.g. [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/))

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2020, 9:44am UTC](https://discuss.elastic.co/t/filebeat-fields-error-message-disable-remove-from-table/223207/3 "2020-04-09T09:44:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
