# Filtering incoming data based on field **URL:** \ **Category:** Logstash\ **Created:** [May 17, 2016, 12:45pm UTC](https://discuss.elastic.co/t/filtering-incoming-data-based-on-field/50223 "2016-05-17T12:45:31Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 17, 2016, 12:45pm UTC](https://discuss.elastic.co/t/filtering-incoming-data-based-on-field/50223/1 "2016-05-17T12:45:31Z")
Hi, I implemented an ELK Stack about a week ago and we have received over 16 million entries which a majority is not necessarily useful and we are looking into filtering it out. Our incoming data is syslog and there is a field called syslog\_program which we want to filter with as a majority of our incoming data has RT\_FLOW as syslog\_program. How can I tell Logstash to discard any RT\_FLOW's so they are not saved and take up storage on our server? What's already there is fine, we just want to make sure in the future RT\_FLOW's are ignored as they are the majority and useless. ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 17, 2016, 2:24pm UTC](https://discuss.elastic.co/t/filtering-incoming-data-based-on-field/50223/2 "2016-05-17T14:24:54Z")
Figured it out, sorry [https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/filtering-incoming-data-based-on-field/50223/3 "2017-07-06T04:57:26Z")