# How Can I extract some fields from existence source in logstash

**URL:** https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877
**Category:** Logstash
**Created:** [July 27, 2018, 6:06am UTC](https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877 "2018-07-27T06:06:50Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Vivek\_Sharma2](https://avatars.discourse-cdn.com/v4/letter/v/cab0a1/32.png) [@Vivek\_Sharma2](https://discuss.elastic.co/u/Vivek_Sharma2)
#### Post date: [July 27, 2018, 6:06am UTC](https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877/1 "2018-07-27T06:06:50Z")

</div>

I'm trying to extract some fields from existence json source.I have s3 bucket as a source and elasticsearch as a destination.  
logstash.config:-

input {  
s3 {  
bucket =\> "logstash-backup111"  
access\_key\_id =\> "\*\*\*\*\*\*\*\*\*\*\*\*\*\*"  
secret\_access\_key =\> "0l\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*J9mqouRA"  
}  
}

filter {  
json {  
source =\> "message"  
target =\> "json"

```
		}
	mutate {
                remove_field => ["[substitution][substitutedProduct]"]
	        }
 }	

```

output {

```
	elasticsearch {
  				hosts => ["localhost:9200"]
		}
	stdout {
		 codec => rubydebug
                   }
   }				

```

Here I'm trying to remove substitutedProduct list ,but in Elasticsearch I'm getting unchanged json.  
please someone help how I extract particular fields.

---

<div class="post-metadata">

### Author: ![Vivek\_Sharma2](https://avatars.discourse-cdn.com/v4/letter/v/cab0a1/32.png) [@Vivek\_Sharma2](https://discuss.elastic.co/u/Vivek_Sharma2)
#### Post date: [July 29, 2018, 8:36pm UTC](https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877/2 "2018-07-29T20:36:15Z")

</div>

**I got answer. Removed all fields and add new fields:-**

filter {  
json {  
source =\> "message"  
target =\> "doc"  
}  
mutate {  
add\_field =\> ["[doc][deliveryDate]", "%{[doc][orderDetails][storeId]}" ]  
add\_field =\> ["[doc][orderStatus]", "%{[doc][orderDetails][orderStatus]}"]  
add\_field =\> ["[doc][channel]" ,"ukghs:online"]  
add\_field =\>["[doc][orderId]" ,"ordernumber%{[doc][orderDetails][customerNumber]}\_%{[doc][orderDetails][storeId]} "]

```
      remove_field => "[doc][orderDetails]"
      remove_field => "[doc][orderLines]"
      remove_field => "[doc][clubCardStatements]"
      remove_field => "[doc][extendedOrder]"
      remove_field => "[doc][clubCardStatements]"
      remove_field => "[doc][paymentAndSavings]"
      remove_field => "[doc][deliveryDetails]"
      remove_field => "[doc][outOfStockProducts]"
      remove_field => "[doc][promotionSavings]"
      remove_field => "[doc][eCoupons]"
      remove_field =>"[doc][substitutions]"
      remove_field =>"[doc][customerDetails]"
}

```

}

**if anyone has better solution please share**

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2018, 8:36pm UTC](https://discuss.elastic.co/t/how-can-i-extract-some-fields-from-existence-source-in-logstash/141877/3 "2018-08-26T20:36:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.