# Filtering- Delete a field to save storage space

**URL:** <https://discuss.elastic.co/t/filtering-delete-a-field-to-save-storage-space/253593>\
**Category:** Logstash\
**Created:** [October 28, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filtering-delete-a-field-to-save-storage-space/253593 "2020-10-28T16:49:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ASRLO](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@ASRLO](https://discuss.elastic.co/u/ASRLO)\
**Post date:** [October 28, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filtering-delete-a-field-to-save-storage-space/253593/1 "2020-10-28T16:49:06Z")

</div>

Hello ,  
I am a beginner on the ELK solution,  
I would like to know if by deleting fields and their contents from my logs I can gain storage space.  
If so, how to do this task?  
This is what I tried to do:  
'  
if [event][module] == "panw"  
{  
geoip {  
source =\> "[client][nat][ip]"  
target =\> "source\_geoip"  
}  
geoip {  
source =\> "[destination][nat][ip]"  
target =\> "destination\_geoip"  
}

# drop {

# remove\_field =\> ["[destination\_geoip][longitude]", "[destination\_geoip][location]","[log\_event][labels]" ,

# "[destination\_geoip][country\_code3]", "[latitude]", "[agent][ephemeral\_id]","[source\_geoip][longitude]",

# "[source\_geoip][location]","[source\_geoip][country\_code3]", "[observer][serial\_number]", "[network][community\_id]",

# "[message]", "[sort]" ]

# remove\_tag =\> ["[destination\_geoip][longitude]", "[destination\_geoip][location]", "[log\_event][labels]" ,

# "[destination\_geoip][country\_code3]" "[latitude]", "[agent][ephemeral\_id]", "[source\_geoip][longitude]",

# "[source\_geoip][location]","[source\_geoip][country\_code3]", "[observer][serial\_number]", "[network][community\_id]",

# "[message]", "[sort]" ]

# }

}  
'  
The goal is to reduce storage space on Elasticsearch

Thank you for your attention

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 28, 2020, 4:58pm UTC](https://discuss.elastic.co/t/filtering-delete-a-field-to-save-storage-space/253593/2 "2020-10-28T16:58:09Z")

</div>

A drop filter will delete the event. If you just want to remove fields then most folk would use a mutate filter. remove\_tag is used to remove strings from the tags array, not to remove fields.

In general, if you remove fields from your events the events will be smaller and will use less space in elasticsearch. The space used by elasticsearch will depend on many factors though. Number of replicas and shards, for example. And [index\_options](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-options.html) can have a large impact.

---

<div class="post-metadata">

**Author:** ![ASRLO](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@ASRLO](https://discuss.elastic.co/u/ASRLO)\
**Post date:** [October 30, 2020, 10:29am UTC](https://discuss.elastic.co/t/filtering-delete-a-field-to-save-storage-space/253593/3 "2020-10-30T10:29:36Z")

</div>

I will try  
thanks you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2020, 10:29am UTC](https://discuss.elastic.co/t/filtering-delete-a-field-to-save-storage-space/253593/4 "2020-11-27T10:29:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.