Hello, I am using filebeat to store logs in ES. filebeat adds some beat.XXX fields and I want to remove them (in order to save space). I am using ES ingest pipeline to process my logs. I tried the following ingest processor: "remove" : { "field": "beat.name" }, but it does not work (field stil…

[image] ywelsch: Maybe also related to Oh, yes! The answer by @mvg in that thread solved my problem. I was missing extra { ... } around each processor! Well, it is really sad that I have no parse error during pipeline creating, but rather such an unexpected behaviour later :frowning:

Discuss the Elastic Stack

How to delete beat.name field?

Elastic Stack Elasticsearch

ywelsch (Yannick Welsch) February 10, 2017, 9:50am 2

Have you checked that the newly indexed documents still contain the beat.name field? Existing indexed documents will still carry that field and you cannot remove an existing field from the mappings.

Maybe also related to:

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.