Filter with Grok and KV

Elastic Stack Logstash
2

If you do not want to keep a field there is no need to name it and the use remove_field. You could just use

match => { "message" => "%{GREEDYDATA}\[Keeper\@Commander%{GREEDYDATA:text}\]%{GREEDYDATA:description} "}

and if a pattern is not anchored it does not need to match the entire field. So you would be better off with

match => { "message" => "\[Keeper\@Commander%{GREEDYDATA:text}\]%{GREEDYDATA:description} "}

Personally I would do that using

match => { "message" => "\[Keeper\@Commander(?<text>[^\]]*)\]%{GREEDYDATA:description} "}

in case a one the kv pairs ever contains ]