Hello, I am using filebeat to store logs in ES. filebeat adds some beat.XXX fields and I want to remove them (in order to save space). I am using ES ingest pipeline to process my logs. I tried the following ingest processor: "remove" : { "field": "beat.name" }, but it does not work (field stil…

[image] ywelsch: Maybe also related to Oh, yes! The answer by @mvg in that thread solved my problem. I was missing extra { ... } around each processor! Well, it is really sad that I have no parse error during pipeline creating, but rather such an unexpected behaviour later :frowning:

How to delete beat.name field?

Elastic Stack Elasticsearch

ywelsch (Yannick Welsch) February 10, 2017, 9:50am 2

Have you checked that the newly indexed documents still contain the beat.name field? Existing indexed documents will still carry that field and you cannot remove an existing field from the mappings.

Maybe also related to:

Topic		Replies	Views
Filebeat (6.5.4) modules how to remove unused fields Beats filebeat	3	1108	April 11, 2019
Using the Remove processor for ingest node Elasticsearch	8	3938	July 5, 2017
How to remove certain fields from filebeat index Beats filebeat	6	5761	August 27, 2020
Mutate remove_field not working for JSON field Logstash	7	6998	July 6, 2017
Cannot remove field with ingest processor Elasticsearch	4	719	December 26, 2020

How to delete beat.name field?

Related topics