# How to delete beat.name field?

**URL:** <https://discuss.elastic.co/t/how-to-delete-beat-name-field/74626>\
**Category:** Elasticsearch\
**Created:** [February 10, 2017, 9:29am UTC](https://discuss.elastic.co/t/how-to-delete-beat-name-field/74626 "2017-02-10T09:29:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 10, 2017, 9:29am UTC](https://discuss.elastic.co/t/how-to-delete-beat-name-field/74626/1 "2017-02-10T09:29:57Z")

</div>

Hello,

I am using filebeat to store logs in ES. filebeat adds some [beat.XXX](http://beat.XXX) fields and I want to remove them (in order to save space).

I am using ES ingest pipeline to process my logs.

I tried the following ingest processor:  
`"remove" : { "field": "beat.name" },`

but it does not work (field still present in ES).  
The same `remove` processor removes my custom fields without a problem.

Why [beat.XXX](http://beat.XXX) fields are immortal?

Thanks.

---

<div class="post-metadata">

**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\
**Post date:** [February 10, 2017, 9:50am UTC](https://discuss.elastic.co/t/how-to-delete-beat-name-field/74626/2 "2017-02-10T09:50:21Z")

</div>

Have you checked that the newly indexed documents still contain the `beat.name` field? Existing indexed documents will still carry that field and you cannot remove an existing field from the mappings.

Maybe also related to:

> [@Using the Remove processor for ingest node](https://discuss.elastic.co/t/using-the-remove-processor-for-ingest-node/56500):
>
> Hi, I am trying to remove some fields from the document using the REMOVE processor in the pipeline. I tried: remove { "field"=\>"a", "field"=\>"b", "field"=\>"c", "field"=\>"d", "field"=\>"e", "ignore\_failure" : true } And: remove { "field"=\>"a", "ignore\_failure" : true }, remove { "field"=\>"b", "ignore\_failure" : true }, remove { "field"=\>"c", "ignore\_failure" : true }, remove { "field"=\>"d", "ignore\_failure" : true }, remove { "field"=\>"e", "ignore\_failure" : true } B…

---

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 10, 2017, 10:30am UTC](https://discuss.elastic.co/t/how-to-delete-beat-name-field/74626/3 "2017-02-10T10:30:37Z")

</div>

> [@ywelsch](#):
>
> Maybe also related to

Oh, yes! The answer by @mvg in that thread solved my problem.  
I was missing extra `{ ... }` around each processor!

Well, it is really sad that I have no parse error during pipeline creating, but rather such an unexpected behaviour later ☹

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2017, 10:31am UTC](https://discuss.elastic.co/t/how-to-delete-beat-name-field/74626/4 "2017-03-10T10:31:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.