# Grok and parsing of logstash data **URL:** \ **Category:** Logstash\ **Created:** [June 23, 2025, 10:29am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408 "2025-06-23T10:29:00Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [June 23, 2025, 10:29am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/1 "2025-06-23T10:29:00Z")
Good morning I am integrating data from an application called telegraf into logstash here is my telegraf conf file ```auto # Global Agent Configuration [agent] hostname = "" flush_interval = "15s" interval = "1500s" omit_hostname = false # gRPC Dial-Out Telemetry Listener [[inputs.cisco_telemetry_mdt]] transport = "grpc" service_address = ":57500" # Output Plugin [[outputs.socket_writer]] address = "tcp://x.x.x.x:5044" data_format = "json" json_timestamp_units = "1ns" [[outputs.file]] files = ["/tmp/telegraf-grpc.log"] ``` and this is the output in /tmp/telegraf-grpc.conf ```auto Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,host=ibcinmnrffd1v,path=Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,source=hclab043-gnmic,subscription=101 five_seconds=1i 1750674175479000000 Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,host=ibcinmnrffd1v,path=Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,source=hclab043-gnmic,subscription=101 five_seconds=0i 1750674180475000000 ``` and this is logstash conf file ```auto # Beats -> Logstash -> Elasticsearch pipeline. input { tcp { port => 5044 codec => json {} } } filter { grok { match => { "message" => [ "%{DATA:metric},host=%{HOSTNAME},path=%{DATA:path},source=%{DATA:source},subscription=%{INT:subscription} five_seconds=%{INT:five_seconds}i %{NUMBER:timestamp}" ] } remove_field => ["host", "path", "tags.host", "_id", "timestamp", "metric", "message"] } mutate { convert => { "five_seconds" => "integer" } add_field => { "cpu_usage_5s_percent" => "%{five_seconds}%%" } } } output { elasticsearch { hosts => ["https://localhost:9200"] index => "streaming-new" user => "elastic" password => "xxxxxxxxxx" #ssl_enabled => true ssl_certificate_verification => false } file { path => "/tmp/streaming-output" } ``` and then this is the output in kibana as i caanot upload it into the forum ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c54a6e3faeac1bc2a9132cfa505f45d7e8638daa.png) i want to remove timestamp, tags , host, \_id, index, score , subscription , using grok but it does not seem to be working ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 23, 2025, 1:23pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/2 "2025-06-23T13:23:23Z")
> [@DOkuwa](#): > > i want to remove timestamp, tags , host, \_id, index, score , subscription , using grok but it does not seem to be working It's not working because your grok pattern is not matching. Event decoration (i.e. add\_field, remove\_field, add\_tag , remove\_tag) only happens if a filter "succeeds". If the grok pattern matches then the remove\_field will happen (it is [not quite that simple](https://github.com/logstash-plugins/logstash-filter-grok/issues/49#issuecomment-460290854) if there are multiple patterns, but you only use one). You are also getting a \_tagsparsefailure tag. Assuming event\_api.tags.illegal is set to rename in logstash.yml that's telling you that the JSON contains a hash called [tags], and [tags] has to be an array of strings, not a hash. If given a hash called [tags] the event creation methods will rename it to [\_tags]. So, you can remove those fields using ``` remove_field => ["_tags"] ``` to remove the whole hash or ``` remove_field => ["[_tags][host]" ] ``` to remove individual members. Note that you are also removing fields that you just created in the grok, so you can just not create them, and you can let grok do the integer conversion. Also, \_id is not an optional field, elasticsearch will create it if it is not supplied. That simplifies things to ``` grok { match => { "message" => [ "%{DATA},host=%{HOSTNAME},path=%{DATA},source=%{DATA:source},subscription=%{INT:subscription} five_seconds=%{INT:five_seconds:int}i %{NUMBER}" ] } remove_field => ["host", "path", "_tags", "message"] add_field => { "cpu_usage_5s_percent" => "%{five_seconds}%%" } } ``` ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [June 26, 2025, 2:13pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/3 "2025-06-26T14:13:03Z")
Hi Thanks for your reply I am still having issues with the grok filter This my new code ```auto input { tcp { port => 5044 codec => json {} } } filter { grok { match => { "message" => "^%{DATA:measurement},host=%{HOSTNAME:_tags.host},name=%{DATA:_tags.name},path=%{DATA:_tags.path},source=%{DATA:_tags.source},subscription=%{INT:_tags.subscription} in_octets=%{INT:in_octets}i %{INT:timestamp}" } } mutate { remove_field => [ "_tags.host", "_tags.name", "_tags.path", "_tags.source", "_tags.subscription", "[_tags][host]", "[_tags][path]", "[_tags][subscription]", "[_tags][name]", "[_tags][source]", "[_tags.host.keyword]", "[_tags.name.keyword]", "[_tags.path.keyword]", "[_tags.source.keyword]", "[_tags.subscription.keyword]", "tags", "tags.keyword" ] } } ``` And also the view and contents in kibana ```auto ![image|690x307](upload://2zf6zftOGqB3VFQRZMUsaItB3db.png) ``` The output details in kibana ```auto { "@timestamp": [ "2025-06-26T13:34:43.291Z" ], "@version": [ "1" ], "@version.keyword": [ "1" ], "_tags.host": [ "ibcinmnrffd1v" ], "_tags.host.keyword": [ "ibcinmnrffd1v" ], "_tags.name": [ "GigabitEthernet0/0" ], "_tags.name.keyword": [ "GigabitEthernet0/0" ], "_tags.path": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "_tags.path.keyword": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "_tags.source": [ "hclab043-gnmic" ], "_tags.source.keyword": [ "hclab043-gnmic" ], "_tags.subscription": [ "106" ], "_tags.subscription.keyword": [ "106" ], "fields.in_octets": [ 1831309585 ], "name": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "name.keyword": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "tags": [ "_tagsparsefailure", "_grokparsefailure", "_dateparsefailure" ], "tags.keyword": [ "_tagsparsefailure", "_grokparsefailure", "_dateparsefailure" ], "timestamp": [ 1750945216505000000 ], "_id": "DV9yrJcBUIBRc1H-okvN", "_index": "streaming-new", "_score": null } ``` Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 26, 2025, 2:52pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/4 "2025-06-26T14:52:55Z")
The fields for which the names end in .keyword are not present in logstash, so remove\_field cannot delete them. They are created by elasticsearch when the document is indexed. You will need to change the document mapping in elasticsearch. See [here](https://www.elastic.co/blog/strings-are-dead-long-live-strings) for the basics of why they were introduced, [here](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/multi-fields) for what the mapping syntax looks like. Kibana and elasticsearch do not present field names in the same way as logstash. In logstash "\_tags.path" has to be referred to as [\_tags][path] logstash can distinguish between fields with . in the name and nested fields, so `{ "a.b": 0 }` would be [a.b], and `{ "a": { "b": 0 } }` would be [a][b]. Names do not work that way in elasticsearch. To understand the structure of the data (and so which name logstash will use) have kibana present the document as JSON. ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 10, 2025, 10:25am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/5 "2025-07-10T10:25:38Z")
Hi, I am still having issues with grok filter This is my configuration # Sample Logstash configuration for creating a simple # Beats -\> Logstash -\> Elasticsearch pipeline. input { tcp { port =\> 5085 codec =\> json {} } } filter { mutate { remove\_field =\> ["[\_tags][host]"] } } output { elasticsearch { hosts =\> ["[https://localhost:9200](https://localhost:9200)"] index =\> "telegraf-new" user =\> "elastic" password =\> "" #ssl\_enabled =\> true ssl\_certificate\_verification =\> false } file { path =\> "/tmp/streaming-output" } } And this is the output in kibana ![](https://us1.discourse-cdn.com/elastic/original/3X/0/7/070a5d7ab5b418ab2870226a8372b9ecf9b87404.png) ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [July 10, 2025, 10:59am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/6 "2025-07-10T10:59:40Z")
Can you copy the message or event.original field? Those where is \_grokparsefailure. Also 1-2 which are without an error. ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 10, 2025, 12:05pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/7 "2025-07-10T12:05:37Z")
Hi This is the output in a text file { "@timestamp": [ "2025-07-10T10:18:24.488Z" ], "@version": [ "1" ], "@version.keyword": [ "1" ], "\_tags.host": [ "ibcinmnrffd1v" ], "\_tags.host.keyword": [ "ibcinmnrffd1v" ], "\_tags.name": [ "GigabitEthernet0/0" ], "\_tags.name.keyword": [ "GigabitEthernet0/0" ], "\_tags.path": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "\_tags.path.keyword": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "\_tags.source": [ "hclab043-gnmic" ], "\_tags.source.keyword": [ "hclab043-gnmic" ], "\_tags.subscription": [ "140" ], "\_tags.subscription.keyword": [ "140" ], "fields.in\_octets": [ 2617367341 ], "name": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "name.keyword": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "tags": [ "\_tagsparsefailure" ], "tags.keyword": [ "\_tagsparsefailure" ], "timestamp": [ 1752143021161000000 ], "\_id": "Ds\_X85cBfkn1XF9i7xLv", "\_index": "telegraf-new", "\_score": null } Thanks Daley ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [July 10, 2025, 12:23pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/8 "2025-07-10T12:23:16Z")
> [@DOkuwa](#): > > ```auto > Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,host=ibcinmnrffd1v,path=Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,source=hclab043-gnmic,subscription=101 five_seconds=1i 1750674175479000000 > Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,host=ibcinmnrffd1v,path=Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilization,source=hclab043-gnmic,subscription=101 five_seconds=0i 1750674180475000000 > > ``` We need something like this. You are removing "message", so it's not visible what came to LS as raw data. ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 10, 2025, 1:09pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/9 "2025-07-10T13:09:43Z")
Hi, Thanks for your quick response {"message":"\<189\>227601: \*Jul 10 13:12:52.119 UTC: %SSH-5-SSH2\_SESSION: SSH2 Session request from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.318901969Z","event":{"original":"\<189\>227601: \*Jul 10 13:12:52.119 UTC: %SSH-5-SSH2\_SESSION: SSH2 Session request from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded"},"type":"syslog"} {"message":"\<189\>227603: \*Jul 10 13:12:52.167 UTC: %SSH-5-SSH2\_USERAUTH: User 't\_dnac' authentication for SSH2 Session from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.319350624Z","event":{"original":"\<189\>227603: \*Jul 10 13:12:52.167 UTC: %SSH-5-SSH2\_USERAUTH: User 't\_dnac' authentication for SSH2 Session from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded"},"type":"syslog"} {"message":"\<189\>227602: \*Jul 10 13:12:52.167 UTC: %SEC\_LOGIN-5-LOGIN\_SUCCESS: Login Success [user: t\_dnac] [Source: 10.200.250.20] [localport: 22] at 13:12:52 UTC Thu Jul 10 2025","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.318984443Z","event":{"original":"\<189\>227602: \*Jul 10 13:12:52.167 UTC: %SEC\_LOGIN-5-LOGIN\_SUCCESS: Login Success [user: t\_dnac] [Source: 10.200.250.20] [localport: 22] at 13:12:52 UTC Thu Jul 10 2025"},"type":"syslog"} {"message":"\<189\>227601: \*Jul 10 13:12:52.119 UTC: %SSH-5-SSH2\_SESSION: SSH2 Session request from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.318901969Z","event":{"original":"\<189\>227601: \*Jul 10 13:12:52.119 UTC: %SSH-5-SSH2\_SESSION: SSH2 Session request from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded"},"type":"syslog"} {"message":"\<189\>227603: \*Jul 10 13:12:52.167 UTC: %SSH-5-SSH2\_USERAUTH: User 't\_dnac' authentication for SSH2 Session from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.319350624Z","event":{"original":"\<189\>227603: \*Jul 10 13:12:52.167 UTC: %SSH-5-SSH2\_USERAUTH: User 't\_dnac' authentication for SSH2 Session from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded"},"type":"syslog"} {"message":"\<189\>227602: \*Jul 10 13:12:52.167 UTC: %SEC\_LOGIN-5-LOGIN\_SUCCESS: Login Success [user: t\_dnac] [Source: 10.200.250.20] [localport: 22] at 13:12:52 UTC Thu Jul 10 2025","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.318984443Z","event":{"original":"\<189\>227602: \*Jul 10 13:12:52.167 UTC: %SEC\_LOGIN-5-LOGIN\_SUCCESS: Login Success [user: t\_dnac] [Source: 10.200.250.20] [localport: 22] at 13:12:52 UTC Thu Jul 10 2025"},"type":"syslog"} {"message":"\<189\>227601: \*Jul 10 13:12:52.119 UTC: %SSH-5-SSH2\_SESSION: SSH2 Session request from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.318901969Z","event":{"original":"\<189\>227601: \*Jul 10 13:12:52.119 UTC: %SSH-5-SSH2\_SESSION: SSH2 Session request from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded"},"type":"syslog"} {"message":"\<189\>227603: \*Jul 10 13:12:52.167 UTC: %SSH-5-SSH2\_USERAUTH: User 't\_dnac' authentication for SSH2 Session from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded","@version":"1","tags":["\_jsonparsefailure","\_grokparsefailure"],"host":{"ip":"10.200.226.59"},"@timestamp":"2025-07-10T13:07:18.319350624Z","event":{"original":"\<189\>227603: \*Jul 10 13:12:52.167 UTC: %SSH-5-SSH2\_USERAUTH: User 't\_dnac' authentication for SSH2 Session from 10.200.250.20 (tty = 0) using crypto cipher 'aes128-ctr', hmac 'hmac-sha2-256-etm@openssh.com' Succeeded"},"type":"syslog"} {"@timestamp":"2025-07-10T13:07:39.711967069Z","tags":["\_tagsparsefailure"],"\_tags":[{"name":"GigabitEthernet0/0","source":"hclab043-gnmic","path":"openconfig-interfaces:interfaces/interface/state/counters","subscription":"140","host":"ibcinmnrffd1v"}],"@version":"1","timestamp":1752153191207000000,"fields":{"in\_octets":2623532390},"name":"openconfig-interfaces:interfaces/interface/state/counters"} {"@timestamp":"2025-07-10T13:08:09.713833274Z","tags":["\_tagsparsefailure"],"\_tags":[{"name":"GigabitEthernet0/0","source":"hclab043-gnmic","path":"openconfig-interfaces:interfaces/interface/state/counters","subscription":"140","host":"ibcinmnrffd1v"}],"@version":"1","timestamp":1752153221206000000,"fields":{"in\_octets":2623594978},"name":"openconfig-interfaces:interfaces/interface/state/counters"} #{"@timestamp":"2025-07-10T13:08:39.714581855Z","tags":["\_tagsparsefailure"],"\_tags":[{"name":"GigabitEthernet0/0","source":"hclab043-gnmic","path":"openconfig-interfaces:interfaces/interface/state/counters","subscription":"140","host":"ibcinmnrffd1v"}],"@version":"1","timestamp":1752153251207000000,"fields":{"in\_octets":2623619950},"name":"openconfig-interfaces:interfaces/interface/state/counters"} Thanks Daley ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 11, 2025, 4:40pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/10 "2025-07-11T16:40:03Z")
Hi , I have removed the \__tags field but still want change field.in_\_octets to in\_octets and also remove some field Such as tags \_id, timestamp, index and score This is an output of the file { "@timestamp": [ "2025-07-11T16:31:13.504Z" ], "@version": [ "1" ], "@version.keyword": [ "1" ], "fields.in\_octets": [ 2682852411 ], "name": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "name.keyword": [ "openconfig-interfaces:interfaces/interface/state/counters" ], "tags": [ "\_tagsparsefailure", "\_grokparsefailure" ], "tags.keyword": [ "\_tagsparsefailure", "\_grokparsefailure" ], "timestamp": [ 1752251801614000000 ], "\_id": "wvBT-pcBuPFZnCR-n1gx", "\_index": "telegraf-new", "\_score": null } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 11, 2025, 6:42pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/11 "2025-07-11T18:42:28Z")
> [@DOkuwa](#): > > "fields":{"in\_octets":2623532390},"name":"..."} That will get parsed as [fields][in\_octets], which you can rename using ``` mutate { rename => { "[fields][in_octets]" => "[in_octets]" } } ``` \_id, \_index and \_score are not optional. elasticsearch will generate them. To remove timestamp just use ``` mutate { remove_field => ["timestamp"] } ``` ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 15, 2025, 3:40pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/12 "2025-07-15T15:40:45Z")
Hi, Thanks It worked but I have another question How can I use kibana GUI to hide those fields such as \_id , \__score ,_\_index and \_ignore They make the GUI looks ugly Thanks Bamidele ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 15, 2025, 5:02pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/13 "2025-07-15T17:02:00Z")
> [@DOkuwa](#): > > How can I use kibana GUI to hide those fields such as \_id , \__score ,_\_index and \_ignore > > They make the GUI looks ugly Can you provide context? Those fields are part of the document, you cannot remove them. ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 16, 2025, 8:51am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/14 "2025-07-16T08:51:38Z")
Hi Thanks for you for your quick response I just want to take out this unwanted field in the GUI below such as \_id , \_score , \_index and \_ignored Is there any way we can use kibana to filter out this metafields ![](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48036cbf35862feab7ee4e341b8247b3507f712f.png) Thanks Bamidele ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 16, 2025, 1:36pm UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/15 "2025-07-16T13:36:26Z")
Now it is more clear. You need to go to Stack Management \> Kibana \> Advanced Settings. Then search for _Meta Fields_ and in the configuration that will be shown, leave only the `_source` field, save and then refresh the browser tab with discover. ---
**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Post date:** [July 17, 2025, 10:43am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408/16 "2025-07-17T10:43:26Z")
Hi, Thanks It worked Thanks Bamidele