# How can i remove field?

**URL:** <https://discuss.elastic.co/t/how-can-i-remove-field/40972>\
**Category:** Logstash\
**Created:** [February 4, 2016, 2:34pm UTC](https://discuss.elastic.co/t/how-can-i-remove-field/40972 "2016-02-04T14:34:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mykolaichenko](https://avatars.discourse-cdn.com/v4/letter/m/41988e/32.png) [@Mykolaichenko](https://discuss.elastic.co/u/Mykolaichenko)\
**Post date:** [February 4, 2016, 2:34pm UTC](https://discuss.elastic.co/t/how-can-i-remove-field/40972/1 "2016-02-04T14:34:22Z")

</div>

Hi!  
I'd like to remove inner filed "message"becouse its epmty.  
How can i make this?  
My rule:

`if [message] == "" { drop { } }`

But its not working.  
Can anyone take advice for me?

[![](https://cloud.githubusercontent.com/assets/10963524/12817524/266c401a-cb5b-11e5-905d-769f2f61db4c.jpg) ](https://cloud.githubusercontent.com/assets/10963524/12817524/266c401a-cb5b-11e5-905d-769f2f61db4c.jpg)

---

<div class="post-metadata">

**Author:** ![Mykolaichenko](https://avatars.discourse-cdn.com/v4/letter/m/41988e/32.png) [@Mykolaichenko](https://discuss.elastic.co/u/Mykolaichenko)\
**Post date:** [February 6, 2016, 8:53pm UTC](https://discuss.elastic.co/t/how-can-i-remove-field/40972/2 "2016-02-06T20:53:35Z")

</div>

I want to find problem with filebeat, why it sends to logstash empty message filed, or process it in logstash.  
So what about this?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 7, 2016, 7:22am UTC](https://discuss.elastic.co/t/how-can-i-remove-field/40972/3 "2016-02-07T07:22:23Z")

</div>

It could very well be because you have consecutive newlines in your logs. You can try filtering these in Logstash based on regular expression:

```
if [message] =~ /^$/ {
    drop {}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/how-can-i-remove-field/40972/4 "2017-07-06T05:12:48Z")

</div>