# How do I use prune inside of a specific field?

**URL:** <https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950>\
**Category:** Logstash\
**Created:** [December 24, 2022, 2:39am UTC](https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950 "2022-12-24T02:39:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ste1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ste1/32/119876_2.png) [@ste1](https://discuss.elastic.co/u/ste1)\
**Post date:** [December 24, 2022, 2:39am UTC](https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950/1 "2022-12-24T02:39:33Z")

</div>

I have a bunch of csv files from which I need to extract the "user" and "hwid" columns from. The csv filter will pull out all of the columns and put them in a field called "data". I then use the prune filter to keep only these 2 fields. The prune filter will work just fine if the target is not defined, however once it is defined it refuses to work. I have looked through the documentation page and there doesnt seem to be a "target field" parameter for the prune filter. How can I prune only the fields inside of the "data" field?

```auto
input {
    file {
        path => "C://file.csv"
        start_position => "beginning"
	sincedb_path => "NUL"
    }
}
filter {
    csv {
	autodetect_column_names => true
        target => "data"
    }
    prune {
        interpolate => true
        whitelist_names=> ["user", "hwid"]
    }
}
output{
	stdout {}
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 24, 2022, 3:10am UTC](https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950/2 "2022-12-24T03:10:54Z")

</div>

The `prune` filter only works on top-level fields, it won't work with nested fields, this is in the documentation.

> This filter currently only support operations on top-level fields, i.e. whitelisting and blacklisting of subfields based on name or value does not work.

If you only want to output `data.user` and `data.hwid` from all the fields in your csv you can do that combining a couple of mutates.

Something like this:

```auto
filter {
  csv {
    autodetect_column_names => true
    target => "_tmp"
  }
  mutate {
    add_field => {
      "[data][user]" => "%{[_tmp][user]}"
      "[data][hwid]" => "%{[_tmp][hwid]}"
    }
  }
  mutate {
    remove_field => ["_tmp"]
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 21, 2023, 3:11am UTC](https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950/3 "2023-01-21T03:11:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.