# How anonymize some fields?

**URL:** <https://discuss.elastic.co/t/how-anonymize-some-fields/36062>\
**Category:** Logstash\
**Created:** [December 1, 2015, 3:11pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062 "2015-12-01T15:11:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sampasei](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sampasei](https://discuss.elastic.co/u/sampasei)\
**Post date:** [December 1, 2015, 3:11pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/1 "2015-12-01T15:11:39Z")

</div>

Hi,  
i have several logs as input: each record log has different field.  
I want to pass some fields and change the remaning ones: some fields are common to all records, others are totally different.  
There's a way to do this without a lot of "if" ??  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 1, 2015, 3:24pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/2 "2015-12-01T15:24:13Z")

</div>

Could you give an example with a couple of if conditionals so that it's more clear what you want to do?

---

<div class="post-metadata">

**Author:** ![sampasei](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sampasei](https://discuss.elastic.co/u/sampasei)\
**Post date:** [December 1, 2015, 3:48pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/3 "2015-12-01T15:48:08Z")

</div>

here is an example

{"local": "1.2.3.4", "timestamp": 14432434.495, "event": "conne", "sensor": "test"}  
{"event": "dce", "uuid": "sadfsdfsd", "timestamp": 1448234223.2078185, "sensor": "test", "dcerpcbind\_transf": "4234342455345", "uid": "4056", "hostname": "rest"}

I want to send to elastic some fields (as local and timestamp) "as is" and send the other ones as null.  
I want to avoid a lot of "if" conditions: how can i do?  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 1, 2015, 5:04pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/4 "2015-12-01T17:04:17Z")

</div>

Why pass them on as null—why not just delete the apparently not very interesting fields?

---

<div class="post-metadata">

**Author:** ![sampasei](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@sampasei](https://discuss.elastic.co/u/sampasei)\
**Post date:** [December 1, 2015, 5:06pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/5 "2015-12-01T17:06:45Z")

</div>

To show that these fields exist

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 1, 2015, 5:35pm UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/6 "2015-12-01T17:35:31Z")

</div>

Okay. I don't think you can set fields to null with the mutate filter so you'll have to use a ruby filter. The example in [http://stackoverflow.com/a/30343349/414355](http://stackoverflow.com/a/30343349/414355) is very close to what you want except that you'll want to change the inner loop statement to this:

```
event[k] = nil unless wanted_fields.include? k
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/how-anonymize-some-fields/36062/7 "2017-07-06T05:20:33Z")

</div>

Closed on July 6, 2017, 5:20am UTC